Export certificates

ITVA can export each certificate in its inventory, with the private key and the certificate chain if ITVA has them. This page explains each export format and what the download contains. By the end, you will have downloaded a certificate in the format that your server or application needs.

Before you begin

• To export one certificate, your role needs the Manage permission for Certificates. Without it, ITVA does not show the Export button.
• To include the private key, ITVA must store the key. ITVA stores it when you issue a certificate with ITVA Generated Private Key or Provide a Private Key. ITVA has no key for certificates from scans, from a CA sync, from Generate on Device, or from a pasted CSR. See PKI and CLM overview.
• To include the certificate chain, ITVA must have the chain certificates. ITVA gets them from the issuer, or from the chain that a server sent during a scan.

Export one certificate

1. In the PKI menu, open Certificates.
2. Open the certificate.
3. Select Export.
4. In Format, select a format. The next section explains each format.
5. If you need the private key, turn on Include private key.
6. If you need the issuing CA and root CA certificates, turn on Include certificate chain.
7. If you turned on Include private key, type a Password. ITVA uses it to encrypt the key.
8. Select Download.

ITVA shows the message "Your download has queued." and your browser saves a zip file. The zip file has the name of the certificate, for example www.example.com.zip.

If ITVA does not store a private key for the certificate, you cannot turn on Include private key. If ITVA has no chain certificates, you cannot turn on Include certificate chain. The PKCS7 - P7B and DER - CER formats cannot hold a private key, so ITVA hides Include private key for them.

Export a version of an enrollment

Each time ITVA issues, renews, or reissues a certificate for an enrollment, it adds a version. To export one version, use the Versions card of the enrollment.

1. In the PKI menu, open Enrollments.
2. Open the enrollment.
3. If the version is not in the Versions card, select Show All.
4. In the row of the version, select Export.
5. Set the format and the switches, then select Download.

Export several enrollments

A bulk export downloads the latest certificate of each enrollment that you select, in one zip file. All enrollments use the same format and switches.

1. In the PKI menu, open Enrollments.
2. Select the enrollments that you want to export.
3. In the menu that shows your selection, select Export.
4. In Format, select a format.
5. Caution: if one selected enrollment has no private key in ITVA, the export fails for all of them. Before the next step, make sure that ITVA stores a key for each enrollment.
6. If you need the private keys, turn on Include private key and type a Password.
7. If you need the chain certificates, turn on Include certificate chain.
8. Select Download.

In a bulk export, both switches are always available, because ITVA does not check each enrollment first. One password encrypts all the private keys in the export. If an enrollment has no certificate yet, the export fails. Issue the certificate first, or remove the enrollment from your selection.

Supported formats

The Format list has five options. Two of them are PEM text files. The other three are binary files.

PKCS8 - PEM

A text file with one or more PEM blocks. ITVA writes the certificate first, then each chain certificate, then the private key. The private key uses the PKCS#8 format for RSA, ECDSA, and ML-DSA keys. An encrypted PKCS#8 key starts with this line:

-----BEGIN ENCRYPTED PRIVATE KEY-----

OpenSSL - PEM

The same layout as PKCS8 - PEM, but the private key uses the traditional OpenSSL format. An RSA key starts with BEGIN RSA PRIVATE KEY and an ECDSA key starts with BEGIN EC PRIVATE KEY. The encryption details are in headers inside the block:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,<IV>

ML-DSA keys have no traditional OpenSSL format. For an ML-DSA key, ITVA writes the key in PKCS#8 format, the same as PKCS8 - PEM.

PKCS12 - PFX

A binary PKCS#12 file that holds the certificate, and the chain and the private key if you include them. PKCS#12 files are also called PFX files. ITVA names the file .p12. If a tool needs the .pfx extension, rename the file. The contents are the same.

If you include the private key, your password protects the full file. If you do not include the key, the file has no password. If a tool asks for a password for this file, leave the password empty. ITVA does not set a friendly name in the file.

PKCS12 - PFX does not support ML-DSA private keys yet. To export an ML-DSA key, use PKCS8 - PEM or OpenSSL - PEM. You can still export an ML-DSA certificate without its key in PKCS12 - PFX.

PKCS7 - P7B

A binary PKCS#7 file in DER encoding. It holds the certificate, and the chain certificates if you include the chain. A PKCS#7 file cannot hold a private key.

DER - CER

The certificate alone, in binary DER encoding. A DER file holds one certificate, so it cannot hold the chain or a private key.

If you turn on Include certificate chain with DER - CER, the zip file has no .cer file. It has only the .crt files, which use PEM encoding. To get a DER file, turn off Include certificate chain.

Private keys and passwords

ITVA always encrypts an exported private key. When you turn on Include private key, you must type a password. ITVA uses the password only for this download. Keep the password, because you need it to open the key.

The password protects a different part of the file in each format:

In the PEM formats, the certificates are not encrypted. Anyone can read them, and only the key needs the password.

What the download contains

Each export downloads as a zip file, also when it holds only one file.

Without the certificate chain

The zip file holds one file in the format that you selected, for example www.example.com.p12. If you include the private key, the key is in that file.

With the certificate chain

The zip file holds each certificate as a separate file, plus a combined file in the format that you selected:

ITVA treats a chain certificate as a root CA if it is self-signed. All other chain certificates are intermediate CAs. For example, a PKCS8 - PEM export with the chain and the private key gives these files:

www.example.com.zip
  www.example.com.crt
  Example Issuing CA.crt
  Example Root CA.crt
  www.example.com-full-chain.pem
  www.example.com.key

File names

ITVA names each file after the common name (CN) of the certificate. If there is no common name, ITVA uses the organization (O). If there is neither, ITVA uses certificate, issuing-ca, or root-ca.

ITVA removes the characters / \ : * ? " < > | from names. It also removes spaces and dots at the start and end, and cuts names to 150 characters. For example, a certificate for *.example.com exports as example.com.zip.

If two certificates in the chain have the same name, ITVA adds the first four hex digits of the serial number, for example Example CA-1a2b.crt. If the name is still in use, ITVA adds a number, for example -2.

Bulk exports

A bulk export downloads as certificates-<YYYY-MM-DD>.zip, with the date in the time zone of your organization. The zip file has one folder for each issuer, and one folder for each enrollment in it. Each enrollment folder holds the same files as a single export. If two enrollments have the same issuer and common name, ITVA adds -2 to the second folder.

certificates-2026-11-02.zip
  Example Issuer/
    api.example.com/
      api.example.com.p12
    www.example.com/
      www.example.com.p12

Check that it worked

Unzip the download. Then use OpenSSL to read each file, and make sure that the subject and expiry date match the certificate in ITVA. Replace <NAME> with the file name from the zip.

For a PEM file or a .crt file, show the first certificate:

openssl x509 -in <NAME>.pem -noout -subject -issuer -enddate

To count the certificates in a full-chain file:

grep -c "BEGIN CERTIFICATE" <NAME>-full-chain.pem

To check the private key and its password, run this command and type the password. If the password is correct, the command shows no error.

openssl pkey -in <NAME>.key -noout

For a PKCS12 - PFX file, show its contents. If the file has no private key, press Enter when OpenSSL asks for the password.

openssl pkcs12 -in <NAME>.p12 -info -noout

For a PKCS7 - P7B file, list its certificates:

openssl pkcs7 -inform DER -in <NAME>.p7b -print_certs -noout

For a DER - CER file:

openssl x509 -inform DER -in <NAME>.cer -noout -subject -enddate

Troubleshooting

There is no Export button

Your role does not have the Manage permission for Certificates. Ask an administrator to add it to your role.

You cannot turn on Include private key

If the switch is off and you cannot change it, ITVA does not store a private key for this certificate. You must get the key from the place where it was made, for example the device. If the switch is not there, you selected PKCS7 - P7B or DER - CER. Select a PEM format or PKCS12 - PFX.

"PKCS#12 doesn't support ML-DSA private keys yet"

The certificate uses an ML-DSA key, and PKCS12 - PFX cannot hold it. Select PKCS8 - PEM or OpenSSL - PEM, or turn off Include private key.

"A password is required to export the private key."

You turned on Include private key without a password. Type a password, or turn off Include private key.

A bulk export fails for one enrollment

The error message starts with the common name of the enrollment that caused it:

• <COMMON_NAME> does not have a certificate. The enrollment has no issued certificate. Issue it, or remove it from your selection.
• <COMMON_NAME>: The certificate must have a private key. ITVA does not store a key for that enrollment. Remove it from your selection, or turn off Include private key.

A tool cannot open the PKCS12 file

ITVA encrypts PKCS12 files with AES-256. Some older tools read only PKCS12 files that use older encryption, and they can report a wrong password. Use a PEM format for these tools.