If you have a CA-signed user certificate or a smart card that contains one, and Windows trusts the root certificate, you can export the root certificate from Windows. If the issuer of the user certificate is an intermediate certificate authority, you can export that certificate.

Procedure

  1. If the user certificate is on a smart card, insert the smart card into the reader to add the user certificate to your personal store.
    If the user certificate does not appear in your personal store, use the reader software to export the user certificate to a file. This file is used in Step 4 of this procedure.
  2. In Internet Explorer, select Tools > Internet Options.
  3. On the Content tab, click Certificates.
  4. On the Personal tab, select the certificate you want to use and click View.
    If the user certificate does not appear on the list, click Import to manually import it from a file. After the certificate is imported, you can select it from the list.
  5. On the Certification Path tab, select the certificate at the top of the tree and click View Certificate.
    If the user certificate is signed as part of a trust hierarchy, the signing certificate might be signed by another higher-level certificate. Select the parent certificate (the one that actually signed the user certificate) as your root certificate. In some cases, the issuer might be an intermediate CA.
  6. On the Details tab, click Copy to File.
    The Certificate Export Wizard appears.
  7. Click Next > Next and type a name and location for the file that you want to export.
    Use the default file type CER for the file that you want to export.
  8. Click Next to save the file as a root certificate in the specified location.

What to do next

Add the CA certificate to a server truststore file.