Where Are SSL Certificates Stored? Find, Export and Move Them

Short answer: where SSL certificates are stored depends on the system. On Linux they are files, usually under /etc/ssl/ or /etc/pki/tls/. On Windows they sit in the certificate store, under Local Computer → Personal. Control panels and browsers keep their own copies. The fastest way to find the files a website really uses is to read the web server configuration.

Platform	Certificates	Private keys
Ubuntu / Debian	/etc/ssl/certs/	/etc/ssl/private/
RHEL / CentOS / Rocky / AlmaLinux	/etc/pki/tls/certs/	/etc/pki/tls/private/
Let’s Encrypt (Certbot)	/etc/letsencrypt/live/<domain>/	Same folder (privkey.pem)
Windows Server	Cert:\LocalMachine\My (certlm.msc → Personal)	In the store, linked to the certificate
cPanel	SSL/TLS → Manage SSL sites	SSL/TLS → Private Keys
Plesk	Websites & Domains → SSL/TLS Certificates	Same screen

Where are SSL certificates stored on Ubuntu and other Linux servers?

On Ubuntu and Debian, certificates usually live in /etc/ssl/certs/ and private keys in /etc/ssl/private/. On RHEL, CentOS, Rocky Linux and AlmaLinux the equivalent folders are /etc/pki/tls/certs/ and /etc/pki/tls/private/. These are conventions, not rules. An admin can put the files anywhere.

The same folders also hold the system’s trusted CA bundle: /etc/ssl/certs/ca-certificates.crt on Debian/Ubuntu and /etc/pki/tls/certs/ca-bundle.crt on RHEL-based systems. Those are root certificates the server trusts, not your website certificate.

How to find the SSL certificate a website uses

Search the web server configuration for the certificate directives. The path you find is the file actually in use.

# Apache (Debian/Ubuntu and RHEL paths)
sudo grep -Ri "SSLCertificate" /etc/apache2/ /etc/httpd/ 2>/dev/null

# Nginx
sudo grep -R "ssl_certificate" /etc/nginx/

Linux: list SSL certificates on a server

# Find certificate and key files under /etc
sudo find /etc -type f \( -name "*.crt" -o -name "*.pem" -o -name "*.key" \)

# Show subject and expiry of one file
openssl x509 -in /etc/ssl/certs/example.com.crt -noout -subject -enddate

# Show the certificate a live site serves
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -enddate

To read every field of a file you found, paste it into our SSL decoder.

Where SSL certificates are stored in Windows

Windows keeps certificates in the certificate store, not in loose files. Server certificates for IIS and most services sit in Local Computer → Personal → Certificates. The private key is stored separately by Windows and linked to the certificate, so you never copy it as a file.

How to find an SSL certificate on Windows Server

1. Press Win + R, type certlm.msc and press Enter. This opens the Local Computer store.
2. Open Personal → Certificates. A key icon on the certificate means the private key is present.
3. In IIS Manager, select the server and open Server Certificates to see which ones IIS can bind.

In PowerShell, list the same store:

Get-ChildItem Cert:\LocalMachine\My |
  Format-List Subject, Thumbprint, NotAfter, HasPrivateKey

With certutil, run certutil -store My. Personal certificates of a single user are under certmgr.msc or Cert:\CurrentUser\My.

Tip: Do not copy files from C:\ProgramData\Microsoft\Crypto\ to move a key. Export a PFX instead. It is the only supported way to take the key with you.

Where do cPanel and Plesk store SSL certificates?

Control panels keep certificates in their own folders. Use the panel’s interface to view and export them, because the panel tracks which file belongs to which site.

• cPanel: per account in ~/ssl/certs/ and ~/ssl/keys/. View and export under SSL/TLS → Manage SSL sites and Private Keys. WHM keeps the installed copies under /var/cpanel/ssl/.
• Plesk (Linux): files under /usr/local/psa/var/certificates/ with generated names. Download them under Websites & Domains → SSL/TLS Certificates.
• Plesk (Windows): in the Plesk data folder and the Windows certificate store. Export from the Plesk interface.

Chrome, Firefox and Windows: certificates in the browser

Browsers keep trusted root certificates and your personal client certificates, not your website’s certificate. Chrome uses its own Chrome Root Store for public CAs, but also reads certificates you or your admin added to the operating system. Open it under Settings → Privacy and security → Security → Manage certificates. Firefox keeps a separate store in your profile under Settings → Privacy & Security → Certificates → View Certificates.

For an SSL certificate download from a website, click the site-information icon in the address bar, open the certificate viewer and export it from the Details tab. This gives you the public certificate only, never the private key. Removing cached or outdated certificates on a device is covered in clear SSL state and update root certificates.

macOS and other places to check

On a Mac, certificates and keys live in Keychain Access. Server or system-wide certificates sit in the System keychain; personal ones in login. List them from Terminal:

security find-certificate -a -c example.com /Library/Keychains/System.keychain

Some software ignores the system folders and keeps its own store. Check these when a certificate is not where you expect it:

• Java applications (Tomcat): a keystore file (.jks or .p12) named in server.xml.
• Docker and Kubernetes: mounted volumes or Kubernetes Secrets of type kubernetes.io/tls.
• Load balancers and CDNs: the provider’s certificate manager, not your server.
• Mail servers: paths in the Postfix, Dovecot or Exchange configuration.

Can I move my SSL certificate to a new server or hosting provider?

Yes, as long as you have the private key that matches the certificate. Export certificate, chain and key (PFX or PEM files), copy them securely and install them on the new server.

If the key is lost, or the old host will not export it, you can reissue the certificate instead. Create a new CSR and key on the new server, then request a reissue in your account. Reissues are free during your plan term. Once the new certificate works, revoke the old one if the old host kept the key.

Same SSL certificate on multiple servers

You can install one certificate on several servers, such as behind a load balancer, by copying the PFX or PEM files to each one. Check the product page for the server licensing terms of your product. Each server with the key is a place it can leak from, so limit copies and protect them. Running several certificates on one server through SNI is covered in our guide to install an SSL certificate.

Can I transfer an SSL certificate to a different domain?

No. The domain name is written into the certificate and signed by the CA, so the certificate cannot be moved to another domain. For a new domain you need a reissue that the product allows, or a new order.

You want to…	Possible?	How
Move to a new server, same domain	Yes	Export PFX/PEM, or free reissue with a new CSR
Replace a lost private key	Yes	Reissue with a new CSR
Add or swap names on a multi-domain certificate	Usually	Reissue within your purchased SAN slots
Change the main domain of a single-domain certificate	Rarely	Depends on the CA; usually a new order
Use the certificate after it expires	No	Renew and install the new certificate

When the term ends, plan ahead and renew an SSL certificate before it expires, then replace the files in the locations above.