Using CertUitl from Windows Server 2003 SP1 or later you can force KeySpec to match your wishes\/needs when importing a PFX (aka PKCS#12) file.
\nThe steps to follow are:<\/p>\n
Using the “Certifiates” MMC export the existing keyset (KeySpec=1) to a PFX file.
\nNote: Please backup this file to a safe location and test if the file can be imported ok on another machine before moving on to the next step.<\/p>\n
Delete the existing certificate from the crypto store (stlll using the MMC).<\/p>\n
Open up a command prompt (CMD.exe)<\/p>\n
Import the PFX file using this command: Enter the passphrase for the pfx when prompted.<\/p>\n You now should have a keyset\/Cert with KeySpec=2. If needed you can now export this into another PFX file using the MMC again.<\/p>\n Alternatively if the above does not work you can use OpenSSL<\/a> and explicitly set the the PFX for key signing.<\/p>\n – > openssl pkcs12 -export -out MY_PFX_FILE.pfx -keysig -inkey Key.pvk -in mycert.spc — Only if you have the SPC and PVK files.<\/p>\n – or –<\/p>\n – > openssl pkcs12 -in MY_PFX_FILE.pfx -out BACKUP_PFX_FILENAME.key — This protects you from overwriting the current PFX.
\n-> certutil -importPFX -user “pfxfilename” AT_SIGNATURE <\/strong><\/p>\n
\n– > openssl pkcs12 -export -out MY_NEW_PFX_FILE.pfx -keysig -in BACKUP_PFX_FILENAME.key –Mark PFX for Key Signing.<\/p>\n