--- title: "How to Share a Private Certificate Through a Secure Link" url: https://uselinkpilot.com/blog/how-to-share-a-private-certificate-through-a-secure-link-safely description: "Separate the certificate from its private key, package the key in a password-protected PFX, send it through a one-time link and send the password separately." lang: en --- Security (https://uselinkpilot.com/blog/category/security) # How to share a private certificate through a secure link safely Separate the certificate from its private key, package the key in a password-protected PFX, send it through a one-time link and send the password separately. LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 26, 2026 · About LinkPilot (https://uselinkpilot.com/about) A certificate request lands in your inbox: a vendor needs your client certificate, a new load balancer needs the wildcard, a colleague needs the signing cert to build a release. The file they are asking for may be harmless or it may be the private key that lets anyone impersonate your service, and the two often travel in the same bundle. To share a private certificate through a secure link safely, first work out which half is actually needed, package the private key so it is useless without a password, send the file through a one-time link (https://uselinkpilot.com/glossary#one-time-link) that is destroyed after one download, and send the password somewhere else. This guide walks through each step with the commands. ## The certificate is public. The key is not. A certificate contains a public key, the subject it was issued to, the issuer and the validity dates. It is designed to be handed out; every browser that connects to your site receives it. The private key is the separate secret that proves you own the certificate. Whoever holds it can decrypt traffic meant for you, sign things as you, or stand up a server that claims to be you. So the first question is whether the recipient needs the key at all. | The recipient wants to | They need | Sensitive? | | --- | --- | --- | | Trust your service or verify a signature | The certificate (and maybe the CA chain) | No | | Install TLS on a server or device they run | Certificate, chain and private key | Yes | | Sign code or documents as your organisation | Certificate and private key | Yes, highly | | Authenticate to a system with a client cert | Certificate and private key | Yes | If the answer is the first row, send the `.crt` or `.cer` file any way you like and stop reading. Everything below is for the rows where the key has to move. ## Check what is in the file before you send it Extensions lie. A `.pem` may hold a certificate, a key, or both. A `.pfx` or `.p12` usually bundles certificate, chain and key behind a password. Inspect before sending: ```bash # what is in this PEM? openssl x509 -in cert.pem -noout -subject -issuer -dates grep -c "PRIVATE KEY" cert.pem # 0 means no key inside # what is in this PFX? (prompts for the password) openssl pkcs12 -in bundle.pfx -info -noout ``` Confirm the subject matches what the recipient asked for and the expiry date (https://uselinkpilot.com/glossary#expiry-date) is in the future. Sending the wrong certificate is common; sending the wrong certificate with its key is a breach. ## Package the key so it is useless on its own If the key must travel, never send it bare. Put it in a format that is encrypted with a password you will send separately. ```bash # bundle certificate, chain and key into a password-protected PFX openssl pkcs12 -export -out service.pfx \ -inkey service.key -in service.crt -certfile chain.crt # or encrypt a PEM key on its own openssl pkey -in service.key -aes-256-cbc -out service.enc.key ``` Use a long password generated by a password manager. The password is the second factor: someone who obtains the file still cannot use it, and someone who obtains the password has nothing to apply it to. ## Send the file through a one-time secure link The link is the delivery step, and the aim is that no copy of the file remains in any message afterwards. 1. **Verify the recipient** against a source you already trust: the ticket, the vendor contact on file, a call. A certificate request from an unexpected address deserves a phone call, not a reply. 2. **Create a secret link (https://uselinkpilot.com/glossary#secret-link) with the file attached.** From a signed-in LinkPilot account, open Secret Links, choose New and attach the PFX or encrypted PEM. Files are limited to 9 MB each, which is thousands of times larger than any key bundle. The attachment is encrypted in your browser before upload and deleted the first time it is downloaded. 3. **Set the expiry to the real window.** An hour if the recipient is waiting, 24 hours across time zones. The single download is the main control; expiry is the backstop for a link nobody opens. 4. **Set the view limit to one.** Two engineers who both need the bundle each get their own link. 5. **Add a passphrase to the link on a Pro account** if it will travel through a channel other people can see. 6. **Send the link** with one line of context: which certificate, which system, when it expires. 7. **Send the file password by a different channel.** A text message, a call, or a second secret link sent by a different route. Never in the same message as the file link, and never in the filename. If the key is PEM text and small, you can paste it straight into the free secret link tool (https://uselinkpilot.com/tools/free-secret-link-generator) instead of attaching a file. The text is encrypted in your browser and destroyed on first open in the same way. ## Tell the recipient what to do with it Send the installation notes with the context message, not with the password: - **Which file to expect**, its format, and the system it belongs on. - **Where to store it**: the server's certificate directory with permissions limited to the service account, or the OS certificate store. Not Downloads, not a shared drive. - **Delete the downloaded copy** once imported, and never commit it to a repository. - **Confirm receipt** by filename and fingerprint, never by sending the file back: ```bash openssl x509 -in service.crt -noout -fingerprint -sha256 ``` ## Afterwards Check that the link shows as revealed and that the recipient confirms the fingerprint matches. Pro accounts can see the audit timeline for the exact time of the download. If the link was opened before the recipient got to it, or the file went to the wrong address, do not wait for evidence of misuse: revoke the certificate with the issuing CA, generate a new key pair, reissue, and replace the certificate everywhere it is installed. Record who received which certificate and when. Keep the record. The file should exist on the systems that need it and nowhere in between. ## Related reading - How to create a temporary secure link for sharing files: https://uselinkpilot.com/blog/how-to-create-a-temporary-secure-link-for-sharing-files - How to share SSH credentials with a link that expires: https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely - Client-side encryption for secret sharing: https://uselinkpilot.com/blog/client-side-encryption-for-secret-sharing - Expiring links: the secret is destroyed, not just redirected: https://uselinkpilot.com/blog/expiring-links-security ## Tools for this article One-Time Secret Link Generator Share a password or note through a link that opens once. https://uselinkpilot.com/tools/free-secret-link-generator Expiring Link Generator Create links that stop working at a set time. https://uselinkpilot.com/tools/temporary-link Self-Destructing Message Send a note that disappears after one read. https://uselinkpilot.com/tools/burn-after-read-secret ## Frequently asked questions ### Is it safe to share a certificate file? ### Should I send the private key with the certificate? ### What is the safest way to share a certificate with its private key? ### Which file format should I use? ### Should a certificate-sharing link expire? ### What if I think the private key was exposed? ## LinkPilot sends a secret link that is gone after it is opened. Encrypted in your browser, revealed once, then destroyed. No account needed. Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator) ## Read next Security ### How to Securely Deliver a Config File to a Developer Split settings from secrets, send the secret values through a one-time link or an attachment that burns after one download, and keep the .env out of git. https://uselinkpilot.com/blog/how-to-securely-deliver-a-config-file-to-a-developer Security ### How to Implement Secure Secret Sharing for Remote Teams Secure secret sharing for remote teams in five steps: inventory, vault or one-time link by lifespan, three rules, the tool inside Slack, and a plan for leaks. https://uselinkpilot.com/blog/how-to-implement-secure-secret-sharing-for-remote-teams Security ### How to Create a Secure Way to Hand Off Credentials Between Teams A secure way to hand off credentials between teams: pick vault or one-time link by how the credential is used, scope it, name an owner and revoke on time. https://uselinkpilot.com/blog/how-to-create-a-secure-way-to-hand-off-credentials-between-teams ## Structured data ```json [ { "@context": "https://schema.org", "@type": "SoftwareApplication", "@id": "https://uselinkpilot.com/#software", "name": "LinkPilot", "applicationCategory": "BusinessApplication", "operatingSystem": "Web", "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "url": "https://uselinkpilot.com", "offers": [ { "@type": "Offer", "name": "Free", "price": "0", "priceCurrency": "USD", "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Pro", "price": "29", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "29", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency", "price": "299", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "299", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency Plus", "price": "799", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "799", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Enterprise", "priceSpecification": { "@type": "PriceSpecification", "priceCurrency": "USD" }, "url": "https://uselinkpilot.com/pricing" } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://uselinkpilot.com/#organization", "name": "LinkPilot", "alternateName": "LinkPilot by TetraCore", "url": "https://uselinkpilot.com", "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "support@uselinkpilot.com", "url": "https://uselinkpilot.com/support" }, "parentOrganization": { "@type": "Organization", "@id": "https://tetracorehq.com/#organization", "name": "TetraCore", "url": "https://tetracorehq.com/" }, "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 }, "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "sameAs": [ "https://x.com/uselinkpilot", "https://www.linkedin.com/company/uselinkpilot", "https://facebook.com/uselinkpilot", "https://github.com/TetraCoreHQ/linkpilot-cli", "https://github.com/TetraCoreHQ/linkpilot-mcp", "https://www.npmjs.com/package/linkpilot", "https://www.npmjs.com/package/@uselinkpilot/sdk", "https://www.npmjs.com/package/@uselinkpilot/mcp", "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "LinkPilot", "url": "https://uselinkpilot.com", "potentialAction": { "@type": "SearchAction", "target": "https://uselinkpilot.com/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://uselinkpilot.com/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://uselinkpilot.com/blog" }, { "@type": "ListItem", "position": 3, "name": "How to Share a Private Certificate Through a Secure Link Safely", "item": "https://uselinkpilot.com/blog/how-to-share-a-private-certificate-through-a-secure-link-safely" } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "@id": "https://uselinkpilot.com/blog/how-to-share-a-private-certificate-through-a-secure-link-safely#article", "headline": "How to Share a Private Certificate Through a Secure Link Safely", "description": "Separate the certificate from its private key, package the key in a password-protected PFX, send it through a one-time link and send the password separately.", "datePublished": "2026-10-26", "dateModified": "2026-10-26", "image": "https://uselinkpilot.com/logo-512.png", "author": { "@type": "Organization", "@id": "https://uselinkpilot.com/author/linkpilot-team#organization", "name": "LinkPilot Team", "url": "https://uselinkpilot.com/author/linkpilot-team" }, "publisher": { "@type": "Organization", "name": "LinkPilot", "url": "https://uselinkpilot.com", "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://uselinkpilot.com/blog/how-to-share-a-private-certificate-through-a-secure-link-safely" } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is it safe to share a certificate file?", "acceptedAnswer": { "@type": "Answer", "text": "The certificate itself contains a public key and identity details, so it is not secret. The private key that goes with it is the sensitive part. Share the certificate freely and the key only when the recipient genuinely needs it, through a one-time link." } }, { "@type": "Question", "name": "Should I send the private key with the certificate?", "acceptedAnswer": { "@type": "Answer", "text": "Only when the recipient has to install the pair on a server or device they control. Many tasks, such as trusting your certificate or verifying a signature, need only the public certificate." } }, { "@type": "Question", "name": "What is the safest way to share a certificate with its private key?", "acceptedAnswer": { "@type": "Answer", "text": "Export a password-protected PFX or encrypted PEM, send the file through a one-time secret link that is destroyed after one download, and send the password by a different channel such as a call or text message." } }, { "@type": "Question", "name": "Which file format should I use?", "acceptedAnswer": { "@type": "Answer", "text": "The one the recipient's system expects. Windows and many appliances take PFX or P12. Linux servers and most web servers take PEM. Confirm the contents with a certificate viewer or openssl rather than trusting the extension." } }, { "@type": "Question", "name": "Should a certificate-sharing link expire?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Set the expiry to the real window, an hour to a day, and rely on the one-time download as the main control. Create a fresh link if the window passes rather than extending it." } }, { "@type": "Question", "name": "What if I think the private key was exposed?", "acceptedAnswer": { "@type": "Answer", "text": "Revoke the certificate with the issuing CA, generate a new key pair, issue a new certificate and replace it everywhere the old one was installed. A leaked private key cannot be made secret again." } } ] } ] ```