How do I get a copy of my private key?

Your private key is created when you generate the Certificate Signing Request (CSR). It is not contained in the SSL certificate issued to you, and it cannot be downloaded from your Servertastic account.

For security reasons, Servertastic and the certificate authority do not normally receive or store your private key. This means we cannot send you a copy.

The key should still be on the server, computer, hosting account or device where the CSR was generated. It may be stored as a .key or .pem file, inside the Windows Certificate Store, or within a keystore such as a .pfx, .p12 or .jks file.

Where should I look?

The location depends on how and where the CSR was created.

If somebody else generated the CSR, such as your web developer, IT team or hosting provider, ask them for the key or for a password-protected PFX/PKCS#12 file containing the certificate and private key.

Apache or NGINX

If you generated the CSR using OpenSSL, the private key is the file specified after -keyout in the original command. For example:

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

In this example, the private key is example.com.key.

If the certificate is already installed, you can check the web server configuration for the path to the key:

• Apache uses the SSLCertificateKeyFile setting.
• NGINX uses the ssl_certificate_key setting.

You can search the usual configuration directories with:

sudo grep -R "SSLCertificateKeyFile" /etc/apache2 /etc/httpd 2>/dev/null
sudo grep -R "ssl_certificate_key" /etc/nginx 2>/dev/null

Access to the private key will normally require administrator or root permissions.

Microsoft IIS

When IIS creates a CSR, the private key remains in the Windows Certificate Store on the server used to create it. IIS does not normally create a separate .key file.

Once the issued certificate has been installed by completing the certificate request, you can export the certificate and its private key:

1. Open Internet Information Services (IIS) Manager on the original server.
2. Select the server name.
3. Open Server Certificates.
4. Select the relevant certificate and choose Export.
5. Save it as a .pfx file and protect it with a strong password.

If the certificate does not offer an export option, the private key may be missing, held in another certificate store, or marked as non-exportable.

If you already have a PFX or PKCS#12 file

A .pfx or .p12 file can contain the certificate and its private key. If your application accepts PFX files, it is usually safer to use the password-protected file without extracting the key.

If a separate PEM private-key file is required, you can extract an encrypted copy with OpenSSL:

openssl pkcs12 -in certificate.pfx -nocerts -out private-key.pem

OpenSSL will ask for the PFX import password and then ask you to set a passphrase for the exported private key.

Check that the private key matches the certificate

If you find more than one possible key, compare the public key derived from each file. Run these commands and compare the resulting SHA-256 values:

openssl x509 -in certificate.crt -pubkey -noout |
openssl pkey -pubin -outform DER |
openssl sha256

openssl pkey -in private-key.pem -pubout -outform DER |
openssl sha256

The values must be identical. If they are different, the private key does not match that certificate.

What if the private key has been lost?

A lost private key cannot be recreated from the CSR or the issued SSL certificate. You will need to:

1. Generate a new private key and CSR on the server where the certificate will be installed.
2. Reissue the certificate using the new CSR.
3. Complete any required domain validation.
4. Install the reissued certificate with its new private key.
5. Store a secure backup of the key or a password-protected PFX file.

If you are unsure where the original CSR was generated, check with your hosting provider, server administrator, IT team or the person who originally ordered the certificate before reissuing it.