diff --git a/security/nss/cmd/certutil/certutil.c b/security/nss/cmd/certutil/certutil.c
index a3a6bc077a5..2507c2a96fd 100644
--- a/security/nss/cmd/certutil/certutil.c
+++ b/security/nss/cmd/certutil/certutil.c
@@ -849,10 +849,10 @@ secu_PrintKeyFromCert(CERTCertificate *cert, void *data)
 {
     FILE *out;
     char *name;
-    SECKEYPublicKey *key;
+    SECKEYPrivateKey *key;
 
     out = (FILE *)data;
-    key = CERT_ExtractPublicKey(cert);
+    key = PK11_FindPrivateKeyFromCert(PK11_GetInternalKeySlot(), cert, NULL);
     if (!key) {
 	fprintf(out, "XXX could not extract key for %s.\n", cert->nickname);
 	return SECFailure;
@@ -2595,6 +2595,7 @@ main(int argc, char **argv)
 	    SECU_PrintError(progName, "unable to generate key(s)\n");
 	    return -1;
 	}
+	privkey->wincx = &pwdata;
 	PORT_Assert(pubkey != NULL);
 
 	/*  If all that was needed was keygen, exit.  */