What does "exporting private keys" mean ( Makecert -pe )?

Question

By specifying a –pe switch ( using Makecert utility ) we make a private key exportable.

a) What is it meant by private key being exportable? That we can copy the created .pvk file ( containing private key ) to another system and use it there?

b) If so, then I assume .pvk is only created if private key is to be exported?! Thus, how do we use/obtain private key when we don't want to export it and thus don't specify –pe switch when creating a certificate?

thank you

Answer 1

Makecert stores the private key of a key pair in a secure area of the local machine. If the private key is not marked as exportable, then the system will not allow anyone to export that private key to a transportable certificate file that can be copied or installed on another machine.

That means, if you don't specify the -pe command line option to MakeCert, the certificate created can only be used to decrypt data on that machine. The public key can be handed out for others to use to encrypt data, but only this machine can decrypt that data using the private key.

This is a good thing for maximum security. A user of the machine or a network attacker cannot steal the private key simply by exporting it to a file and running off with the file.

However, it's not the most convenient for ease of use. If you intend for multiple machines to decrypt data encrypted with the public key, then you will need to create the key with the exportable option so that you can export the public/private key pair and install them on the other machines you want to decrypt data on.