Where your digital certificates are and how to export them to .pfx
To sign a PDF with a digital certificate you need a .pfx or .p12 file. If your certificate is “installed” on your system or in your browser, you will not see that file: it has to be exported. This guide explains where certificates are stored and how to make a copy that includes the private key.
-
Find out how your certificate is stored
It may be installed on your system (Windows or macOS), installed in Firefox, saved in a .pfx or .p12 file (a backup you downloaded) or inside a card, such as the Spanish DNIe. In Spain, the FNMT certificate stays installed in the browser you downloaded it from. If you already have the file, skip to step 3.
-
Export it to a file according to your system
- Windows: press Windows + R, type certmgr.msc and press Enter. Open “Personal › Certificates”, right-click your certificate and choose “All tasks › Export…”. Tick “Export the private key”, choose the .PFX format and set a password.
- Chrome or Edge on Windows: in Settings search for “certificates” and open “Manage certificates”: the same Windows window opens and the process is the one above.
- macOS: open “Keychain Access”, choose the “login” keychain and the “My Certificates” category. Right-click your certificate, “Export…”, .p12 format and a password.
- Firefox: Settings › Privacy & Security › “View Certificates” › “Your Certificates”. Select yours and click “Backup…”: it is saved as a .p12 with the password you choose.
- If “Export the private key” is greyed out (in the Windows wizard, the “PKCS #12 (.PFX)” option appears in grey), the certificate has no exportable key. This can be because it is on a card such as the DNIe, because it was installed without allowing export, or because it is a certificate without a private key. Check in the certificate’s “General” tab whether it says “You have a private key that corresponds to this certificate”. If it was installed without allowing export, you will need to obtain it again allowing it to be exported (ask whoever issued it).
-
Save the file where you can find it
.pfx and .p12 are the same format. They usually end up in Downloads or Documents; on Windows you can search for *.pfx or *.p12 in File Explorer. Then, in JapalTools, click “Choose file…”: in Chrome and Edge it opens in Downloads and remembers the last folder you used.
Where each certificate is stored
- Windows: in the user certificate store (certmgr.msc › Personal), shared by Chrome and Edge.
- macOS: in the “login” keychain, “My Certificates” category.
- Firefox: in its own store inside the profile. It cannot be used directly: you have to make a copy (.p12).
- DNIe and cards: the private key is inside the chip and cannot be exported. To sign with a card you need an installed application, such as AutoFirma.
Look after your copy of the certificate
- Strong password: you choose it when exporting; without it the file cannot be used. If you lose it, you will have to export the certificate again.
- Keep it somewhere safe: anyone with the file and the password can sign in your name. Do not email it or share it.
- Delete it when you finish if you no longer need it: your certificate stays installed on your system.
- JapalTools does not store it: it reads it in your browser’s memory and it disappears when you close or reload the page.
In your country: which certificate is used and how to get the file
- Who issues them: certificates come from trust service providers, for example DigiCert, GlobalSign or Sectigo, or from a national scheme in your country (your tax office, bank or professional body often tell you which one they accept).
- In what form: software certificates are .pfx/.p12 files you can export. Hardware tokens and smart cards keep the key inside the chip and cannot be exported.
- What to do: make the copy (.pfx) on the same computer and browser where you installed it. If it will not let you export, ask the issuer how to obtain an exportable certificate.
Your document never leaves your device: JapalTools processes it in your own browser and never uploads it to any server, which matters when it contains personal or tax data.