Question: Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?

Is the only way I can do that by converting both the cert and the private key to a "Personal Information Exchange (PKCS #12)" file and importing that?

Maybe this question would be better on superuser.com? Either way, thanks!

Answer: 
The answer to your question is **Yes**. You must convert the X.509 into a PFX and import it. There is no separate key store in Windows.

You can convert your certificate using OpenSSL with the following command:

```
openssl pkcs12 -export -out cert.pfx -inkey private.key -in cert.crt -certfile CACert.crt

```
In Windows, you *can* have private keys "by themselves". Programmatically, you use [`CryptAquireContext()`](http://msdn.microsoft.com/en-us/library/windows/desktop/aa379886%28v=vs.85%29.aspx) to access a key "by name". The CryptoAPI contains many functions which allow you to import and use keys, independently of certificates.

However, there is no existing graphical interface or file format for handling private keys, and applications do not use keys by name. They use *certificates*. Certificates, in Windows, are stored "elsewhere", but each certificate in the "My" store can optionally contain a link to a corresponding private key (the link would really be a CSP name, and name of a container within that CSP). This maps to what is expected in various protocols. For instance, in SSL, when the server requests a client authentication with a private key, it actually asks for a certificate: the client must present a certificate, and then, only then, demonstrate that it also has access to the corresponding private key.

Thus, in practice, certificates and keys "live together" and keys are reached only through certificates. A certificate and its private key travel together, and this means a PKCS#12 file (aka "PFX").