Certificate Management Service:Download a private certificate

Prerequisites

A private certificate has been issued from an intermediate CA. For more information, see Apply for a private certificate.

Procedure

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > Private Certificate Management.

3. On the Private CAs tab, find the target intermediate CA, and in the Actions column, click Certificates.

4. On the Certificates page, find the target private certificate, and in the Actions column, click Download.

5. In the Download Certificate dialog box, select a certificate format and click Confirm and Download.

   Select Include Trust Chain to include the complete certificate chain in the download package.

   Select the certificate format based on your server or application platform:

   • PEM — Apache, NGINX, and most Linux-based web servers

   • PFX — Windows environments such as IIS and Exchange

   • JKS — Java applications such as Tomcat and Jetty

   • PKCS#8 — Apache servers that read private keys in PKCS#8 format

   • CRT — Scenarios that require the certificate, certificate chain, and private key as separate files

6. The following table describes the supported certificate formats and the files included in each download package.

   Certificate format	Description
   PEM	A Base64-encoded certificate file format. Commonly used for Apache, NGINX, and most other web servers or applications. The download package contains two files: a private certificate (public key) with a .pem extension, and a private key with a .key extension.
   PFX	A binary format, also known as PKCS#12, that contains both the public key and private key. Commonly used in Windows environments such as IIS and Exchange servers. The download package contains two files: a private certificate (public key + private key) with a .pfx extension, and a certificate password file with a .txt extension to protect the private key.
   JKS	A keystore format specific to the Java platform. Commonly used for Java applications and services such as Tomcat and Jetty web servers. The download package contains two files: a private certificate (public key + private key) with a .jks extension, and a certificate password file with a .txt extension to protect the private key.
   PKCS#8	A file format specification for storing private keys. This is the standard format that Apache uses to read private keys, making it suitable for Apache server certificate installation. The download package contains two files: a private certificate (public key) with a .pem extension, and a private key stored in PKCS#8 format with a .key extension.
   CRT	A binary format that contains the certificate and related metadata (issuer information, validity period, subject) but does not include the private key. Generally used to verify the identity of servers, clients, or other entities. The download package contains three files: a private certificate (public key) with a .crt extension (typically named xxx_public.crt), a certificate chain with a .crt extension (typically named xxx_chain.crt, requires selecting Include Trust Chain), and a private key with a .key extension.

7. After the download completes, verify that the package contains the expected files as described in the table above.