Manual Key Archival and Recovery

Windows public key infrastructure (PKI) users have several options for manually backing up their private encryption keys. The preferred and most commonly used format for archived private keys is a Public-Key Cryptography Standards (PKCS) #12 (.pfx) file. Users can use a password to secure access to and confidentiality of a .pfx file's content. To manually back up private keys to this type of file, a user can do one of the following:

Users can also archive their private encryption keys from Microsoft Outlook. Outlook doesn't store the keys in a .pfx file; instead, it uses a special Outlook export (.epf) file. The .epf extension shows the historical roots of Outlook's secure mail technology: EPF stands for Entrust profile. One reason Outlook still uses this format is that it supports X.509 Version 1 certificates, which early Exchange Key Management Service (KMS) implementations use. As with .pfx files, users can use a password to secure .epf files.

To export private encryption keys from Outlook, a user can select Tools, Options from the Outlook menu bar, then go to the Security tab. At the bottom of the Security tab, the user should click ImportExport to open the ImportExport Digital ID dialog box. In that box, the user should select the Export your Digital ID to a file option, then select the Digital ID of the private key the user wants to export and fill in a filename and password. The user shouldn't select the Delete Digital ID from system check box.