Question: Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?

Is the only way I can do that by converting both the cert and the private key to a "Personal Information Exchange (PKCS #12)" file and importing that?

Maybe this question would be better on superuser.com? Either way, thanks!

Answer: 
The answer to your question is **Yes**. You must convert the X.509 into a PFX and import it. There is no separate key store in Windows.

You can convert your certificate using OpenSSL with the following command:

```
openssl pkcs12 -export -out cert.pfx -inkey private.key -in cert.crt -certfile CACert.crt

```
Pub/priv key pairs should be imported into Windows using a PKCS12 (.p12/pfx) when you're using it as a client certificate. That's all there is to it here...

If you're importing it into IIS that's a bit different, but that doesn't seem to be what you're doing. Just in case - IIS requires a slightly different format than X.509 for its certificates; it requires a PKCS7 instead of generic X.509 because PKCS7 includes the signer certificates, whereas X.509 only has the individual certificate which has been signed. This differs from the typical Apache implemention where the signer certificates are included in a [trusted] cert bundle.