In this demonstration, we're going to recover a key with a key recovery agent.
What we're going to do is we're going to go through there and delete our
certificate, and then we find the key and recover the key.
We begin here on CA2, and we have our freshly minted certificate right here.
I'm going to double‑click it so you can see it. It has the details,
the certification path, and I'm going to click on OK. Now,
here's the mistake we make, right? We're going to right‑click,
and oops, delete this certificate,
which means that from a user perspective, that certificate
is gone, they don't know where it is, it is just gone.
So, we need to go in and recover that certificate. How we do it,
one of the first things we do is come over here,
we're going to close this,
we're going to go to our Certification Authority. We're going to
expand that and go to Issued Certificates, and it should be the last
one we issued. It sure is, it's right here.
And what I'm going to do is double‑click on this,
which brings up the properties, and what we need to do
is get the serial number from this.
So here it is right here,
Serial number. I'm going to come over here. And, the
right‑click doesn't work on this.
You're going to have to hit Ctrl+C. Now what we're going to do is
come down here and start Notepad. By coming down here and typing in
Notepad, it's right there, and then I'll just paste this in to make
it kind of simple. And what we're going to do is build the command
around this.
So, the command is this in order to recover that certificate.
The first thing we have to do is get the key, and we get the key by
identifying the certificate by its serial number.
So, certutil is a utility,
a command line utility, that is used to perform a lot of
things on certification authority.
So certutil, the command is getkey, and we use the serial number,
and then right after the serial number we tell it where to put
it. And in this case it is outputblob. Now we are ready for this.
I'm going to right‑click,
I'm going to copy this, and we come down to a PowerShell. Again,
type in power, hit Return, that's basically it.
So I'm going to right‑click and that should paste it in there, and we have our
command, certutil ‑getkey, the serial number of the key, and where to put it,
output blob. Hit Return. Recovery Candidates right here. We had 1. And the
GetKey command completed successfully.
So now we need to type this in. Again,
certutil, and now instead of getkey it's recoverkey. Where is it?
It's in the outputblob. And the name of it, if you remember,
archive.pfx. Hit return. It might be a good idea to put a password in
if you have some kind of key that is vital. This one not, and for
demonstration purposes we did not put it in there. And we have
recovered our file. Notice where it is.
It's in the Administrator.CARVEDROCK.
So let's go there now.
It will be under the C drive, and this one is just the one we
brought in in order to import that key.
What we're going to do is say Users,
we have the Administrator right here, and there is our key, a PFX file.
So all we have to do now is click it. Right‑click,
Install PFX. And I'm going to say Next.
It gives the location. And click on Next again.
If we had password in here, we would use this.
We're going to take the default and click Next again.
Now it will ask us what certificate store do you want to put it in.
We're going to let it figure it out; however,
if you had a specific certificate store,
you would want to use this to put it there.
I'm going to click on Next, and then finally Finish. The import was successful.
Let's go in there and close or minimize all this and
take a look and see if we have it.
It should be under Certificates, Personal, Certificates.
I can right‑click and say Refresh, and there is our recovered
certificate. So, we've recovered the keys because they were auto
archived. We've made ourselves a recovery agent, or rather the
administrator account a recovery agent, and went through here,
deleted it accidentally, and then came back in and restored it.
So that is how you make a key automatically archive and then recover that key with a recovery agent.