Firefox won't export your digital certificate: the fix is in Windows
A user reports that Firefox returned an error when exporting his FNMT certificate. Another forum member told him to export it from the Windows certificate manager instead.
English · Original discussion in Spanish · Published
The Firefox bug that blocks digital certificates
An error when saving the PKCS #12 backup file. That is the message Firefox returns, according to one user, when he tries to export his digital certificate from the FNMT (Spain's national mint, which issues citizens' digital certificates) and finds that the browser flatly refuses. It happens right as he is packing up: the computer where the certificate is installed is «about to die» and the user needs to move it to another machine because he uses it every day. The FNMT, in its instructions 1377, suggests deleting Firefox's root certificates before exporting. It doesn't work. The error persists. And the alternative of installing the originals in another browser on the same computer doesn't cut it either: the system doesn't recognize them because they are not backups.
What to do when Firefox won't export the digital certificate
The solution that unblocks the problem doesn't go through Firefox. It goes through the Windows certificate manager, a tool that has existed since XP and that in Windows 10 still works without fuss. From there you can export the certificate by checking the «export the private key» option and assigning it a password. That's confirmed by the person who tried it after days of failed attempts: «I can't BELIEVE it. You saved my life in two lines». The Windows manager exports the certificate to a file that can then be imported on any other computer. The key lies in the private key: without it, the certificate is a seal without a signature.
Why the FNMT doesn't explain this
The FNMT publishes guides and FAQs, but the solution to the export failure in Firefox appears nowhere. Some argue that the administration assumes citizens already know their way around the system's certificate store. Others point out that the problem lies with Firefox, which has been accumulating glitches with FNMT certificates. According to the official documentation cited in the thread, Firefox works correctly with the FNMT root certificate from version 51 onwards, from January 2017. From then on, users report that updates sometimes fix the problem and sometimes make it worse. One participant sums it up bluntly: «Firefox usually gives trouble with certificates even when you export them using the pc's system».
The myth that the certificate only works on one computer
At service counters and on support phone lines, a false idea keeps coming up: that the digital certificate only works on the computer where it was requested. It isn't true. It can be exported and installed on several machines, on a USB drive or on a mobile phone. The confusion comes from mixing two different things: the application process, which does require doing it from the same browser, and later use, which has no strings attached. A real exception is the cryptographic cards that the FNMT and Telefónica sold years ago: there is no way to export the private key from those. For all other cases, the certificate is portable.
The alternative many overlook
If the certificate was installed only in Firefox, it won't be in Chrome or Edge. Each browser has its own store. Chrome and Edge read the system store; Firefox uses its own. That's why exporting from the Windows manager works even when Firefox refuses. The resulting file can be saved in Google Drive, on a USB drive or in your email, with a password you won't forget. Some recommend putting it in a RAR archive with a password different from the certificate's. And for those handling many certificates, the advice is repeated: use the Windows manager as the main store, because Firefox doesn't let you sort or search them properly.
The digital certificate is the entry key to Spain's e-government services. When it fails, citizens are locked out of their own home. The solution exists, it's free and it's hidden in a menu almost nobody visits. The surprising fact: the tool that solves the problem has been installed in Windows for more than two decades. Nobody mentions it until someone stumbles upon it.
An error when saving the PKCS #12 backup file. That is the message Firefox returns, according to one user, when he tries to export his digital certificate from the FNMT (Spain's national mint, which issues citizens' digital certificates) and finds that the browser flatly refuses. It happens right as he is packing up: the computer where the certificate is installed is «about to die» and the user needs to move it to another machine because he uses it every day. The FNMT, in its instructions 1377, suggests deleting Firefox's root certificates before exporting. It doesn't work. The error persists. And the alternative of installing the originals in another browser on the same computer doesn't cut it either: the system doesn't recognize them because they are not backups.
What to do when Firefox won't export the digital certificate
The solution that unblocks the problem doesn't go through Firefox. It goes through the Windows certificate manager, a tool that has existed since XP and that in Windows 10 still works without fuss. From there you can export the certificate by checking the «export the private key» option and assigning it a password. That's confirmed by the person who tried it after days of failed attempts: «I can't BELIEVE it. You saved my life in two lines». The Windows manager exports the certificate to a file that can then be imported on any other computer. The key lies in the private key: without it, the certificate is a seal without a signature.
Why the FNMT doesn't explain this
The FNMT publishes guides and FAQs, but the solution to the export failure in Firefox appears nowhere. Some argue that the administration assumes citizens already know their way around the system's certificate store. Others point out that the problem lies with Firefox, which has been accumulating glitches with FNMT certificates. According to the official documentation cited in the thread, Firefox works correctly with the FNMT root certificate from version 51 onwards, from January 2017. From then on, users report that updates sometimes fix the problem and sometimes make it worse. One participant sums it up bluntly: «Firefox usually gives trouble with certificates even when you export them using the pc's system».
The myth that the certificate only works on one computer
At service counters and on support phone lines, a false idea keeps coming up: that the digital certificate only works on the computer where it was requested. It isn't true. It can be exported and installed on several machines, on a USB drive or on a mobile phone. The confusion comes from mixing two different things: the application process, which does require doing it from the same browser, and later use, which has no strings attached. A real exception is the cryptographic cards that the FNMT and Telefónica sold years ago: there is no way to export the private key from those. For all other cases, the certificate is portable.
The alternative many overlook
If the certificate was installed only in Firefox, it won't be in Chrome or Edge. Each browser has its own store. Chrome and Edge read the system store; Firefox uses its own. That's why exporting from the Windows manager works even when Firefox refuses. The resulting file can be saved in Google Drive, on a USB drive or in your email, with a password you won't forget. Some recommend putting it in a RAR archive with a password different from the certificate's. And for those handling many certificates, the advice is repeated: use the Windows manager as the main store, because Firefox doesn't let you sort or search them properly.
The digital certificate is the entry key to Spain's e-government services. When it fails, citizens are locked out of their own home. The solution exists, it's free and it's hidden in a menu almost nobody visits. The surprising fact: the tool that solves the problem has been installed in Windows for more than two decades. Nobody mentions it until someone stumbles upon it.
Also available in: Deutsch
Summary of a discussion on Burbuja.info - Foro de economía, actualidad y política., translated from Spanish and reviewed before publication. Read the full discussion (41 replies).
More summaries
-
DevOps demands Linux: Why switch from Windows?
Users increasingly migrate to Linux for DevOps terminal mastery. Hardware barriers are gone, but specialized software and inertia remain obstacles.
-
Cheap Windows and Office Keys: 6€ vs. 120€ Official
Windows and Office keys for 6 euros vs. 120 official: the parallel market validated by Microsoft but lacking ownership proof.
-
Spain's Public Procurement Portal Blocked by Obsolete Java Web Start
Electronic bidding in Spain fails as the state portal relies on Java Web Start, removed since Java 11.
-
Self-employed in Spain: the €254 monthly fee debate and the UK route
An entrepreneur asks what happens if he doesn't pay Spain's €254 self-employed contribution; the thread drifts into setting up UK companies and doubts about…
-
Online quote sites: you pay for leads that often don't exist
Tradespeople pay between 6 and 30 euros for leads that often never reply. The business model of online quote websites always leaves the bill on the same side.
-
Wives donate kidneys to husbands six times more often than the other way around
Wives donate kidneys to their husbands six times more often than husbands do to wives, according to studies in several countries. The biology of pregnancy and cultural factors explain the gap.