I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers.

Unfortunately, the Visual Studio ClickOnce manifest code signing tool only supports the older CSP/CrytoAPI keys for signing these manifests (the error I get is: "An error occurred while signing: Invalid provider type specified.").

I have the certificate currently as a .PFX file on my computer. When I use certutil to view the details of the certificate, it shows these details:

Provider = Microsoft Software Key Storage Provider
ProviderType = 0

How can I change my private key/certificate from using CNG to using the older style CrytoAPI? I don't want to buy another certificate if at all possible.

1 Answer 1


It can be done using openssl. The procedure is as follows:

  • convert the source PFX to PEM
  • convert the PEM back to PFX


openssl pkcs12 -in mycert-cng.pfx -out mycert.pem
openssl pkcs12 -export -in mycert.pem -out mycert-cryptoapi.pfx

On my machine (Windows 8.1, openssl 0.9.8zf), the resulting pfx referenced the "Microsoft Enhanced Cryptographic Provider v1.0" CSP. openssl pkcs12 also provides an option to request a specific CSP (-CSP "CSP name").

Windows binaries of openssl can be downloaded e.g. from here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .