Certificates and Private Keys

Digital certificate files may or may not include a private key, depending on their format and intended use. Here's a breakdown:

Certificate File Formats That Do Not Include a Private Key

These formats typically contain only the public certificate (and sometimes a certificate chain):

Certificate File Formats That Include a Private Key

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Private Key Storage Locations (Platform-Specific)

Windows (CryptoAPI / CNG)

• Certificates can be stored in the Windows Certificate Store (using MMC or Certmgr).
• Private keys are often stored in a CSP or KSP and are non-exportable unless explicitly allowed.
• Examples:
  • MY (Personal) store for user-level certs.
  • Certificates may be backed by TPM, smart card, or HSM.

macOS (Keychain Access)

• Certificates and their private keys are stored in the Keychain.
• System and user keychains are separated.
• Access controls (e.g., biometric prompts) may protect use of the private key.

Smart Card or HSM

• Private keys never leave the device.
• Operations like signing or decryption are performed inside the secure element.
• Access typically uses a PKCS#11 interface or proprietary API.
• Example: A certificate stored on a YubiKey or REALSEC HSM is publicly accessible, but private key use requires PIN and cannot be exported.

  ---

Summary