Question: Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?

Is the only way I can do that by converting both the cert and the private key to a "Personal Information Exchange (PKCS #12)" file and importing that?

Maybe this question would be better on superuser.com? Either way, thanks!

Answer: 
The answer to your question is **Yes**. You must convert the X.509 into a PFX and import it. There is no separate key store in Windows.

You can convert your certificate using OpenSSL with the following command:

```
openssl pkcs12 -export -out cert.pfx -inkey private.key -in cert.crt -certfile CACert.crt

```
A PKCS12 (\*.p12, or \*.pfx) is absolutely the easy way. There are quite a few common tools out there for combining a key pair and certificate into a p12. My favorite is OpenSSL, since it works on every OS I've ever needed to use it on and it's reasonably standards compliant. [Here](https://www.google.com/#hl=en&tbo=d&sclient=psy-ab&q=creating+a+pkcs12+with+openssl&oq=creating+a+PKCS&gs_l=hp.3.2.0l3j0i30.1266.5892.0.8936.20.20.0.0.0.0.208.2028.13j6j1.20.0.les;eqn,rate_low=0-035,rate_high=0-035,min_length=2,cconf=1-2,second_pass=false,num_suggestions=1,ignore_bad_origquery=true,onetoken=false..0.0...1c.1.TwORQ-ztZbQ&pbx=1&bav=on.2,or.r_gc.r_pw.r_cp.r_qf.&bvm=bv.1355534169,d.dmQ&fp=a5dcfad2a6298f40&bpcl=40096503&biw=1229&bih=853)'s a diverse collection of pages on how, although mileage will vary based upon how your key pair and certificate are currently stored. 

Also - most devices with an export capability will offer a PKCS12 generation option if the settings allow key export - its more or less the standard for most PKI enabled applications, and the few cases where this is not the norm (Java for example), there is still usually a conversion or export capability.

One note - if you have a case where your key is on a hardware token or module, you can still reference it from the Microsoft Cert Store - you just need to import the certificate and instruct Microsoft on where the key is stored... to do this, you need to follow the device's instructions for updating the certificate store.