diff --git a/src/Sign.Cli/CodeCommand.cs b/src/Sign.Cli/CodeCommand.cs
index a541d60d..cea545d2 100644
--- a/src/Sign.Cli/CodeCommand.cs
+++ b/src/Sign.Cli/CodeCommand.cs
@@ -31,6 +31,7 @@ internal sealed class CodeCommand : Command
         internal Option<HashAlgorithmName> TimestampDigestOption { get; } = new(["--timestamp-digest", "-td"], HashAlgorithmParser.ParseHashAlgorithmName, description: Resources.TimestampDigestOptionDescription);
         internal Option<Uri?> TimestampUrlOption { get; } = new(["--timestamp-url", "-t"], ParseUrl, description: Resources.TimestampUrlOptionDescription);
         internal Option<LogLevel> VerbosityOption { get; } = new(["--verbosity", "-v"], () => LogLevel.Warning, Resources.VerbosityOptionDescription);
+        internal Option<string> CertificateExportOption { get; } = new(["--certificate-export-path", "-co"], Resources.CertificateExportPathOptionDescription);
 
         internal CodeCommand()
             : base("code", Resources.CodeCommandDescription)
@@ -56,6 +57,7 @@ internal CodeCommand()
             AddGlobalOption(TimestampDigestOption);
             AddGlobalOption(MaxConcurrencyOption);
             AddGlobalOption(VerbosityOption);
+            AddGlobalOption(CertificateExportOption);
         }
 
         internal async Task HandleAsync(InvocationContext context, IServiceProviderFactory serviceProviderFactory, ISignatureProvider signatureProvider, string fileArgument)
@@ -74,6 +76,7 @@ internal async Task HandleAsync(InvocationContext context, IServiceProviderFacto
             LogLevel verbosity = context.ParseResult.GetValueForOption(VerbosityOption);
             string? output = context.ParseResult.GetValueForOption(OutputOption);
             int maxConcurrency = context.ParseResult.GetValueForOption(MaxConcurrencyOption);
+            string? certificateExportPath = context.ParseResult.GetValueForOption(CertificateExportOption);
 
             // Make sure this is rooted
             if (!Path.IsPathRooted(baseDirectory.FullName))
@@ -184,7 +187,8 @@ internal async Task HandleAsync(InvocationContext context, IServiceProviderFacto
                 timestampUrl,
                 maxConcurrency,
                 fileHashAlgorithmName,
-                timestampHashAlgorithmName);
+                timestampHashAlgorithmName,
+                certificateExportPath);
         }
 
         private static string ExpandFilePath(DirectoryInfo baseDirectory, string file)
diff --git a/src/Sign.Cli/Resources.Designer.cs b/src/Sign.Cli/Resources.Designer.cs
index a6ca049b..724b6031 100644
--- a/src/Sign.Cli/Resources.Designer.cs
+++ b/src/Sign.Cli/Resources.Designer.cs
@@ -1,4 +1,4 @@
-//------------------------------------------------------------------------------
+//------------------------------------------------------------------------------
 // <auto-generated>
 //     This code was generated by a tool.
 //     Runtime Version:4.0.30319.42000
@@ -87,6 +87,15 @@ internal static string CertificateStoreCommandDescription {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Path to export the signing certificate to..
+        /// </summary>
+        internal static string CertificateExportPathOptionDescription {
+            get {
+                return ResourceManager.GetString("CertificateExportPathOptionDescription", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Client ID to authenticate to Azure..
         /// </summary>
diff --git a/src/Sign.Cli/Resources.resx b/src/Sign.Cli/Resources.resx
index db7e72d3..44d53743 100644
--- a/src/Sign.Cli/Resources.resx
+++ b/src/Sign.Cli/Resources.resx
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <root>
   <!-- 
     Microsoft ResX Schema 
@@ -126,6 +126,9 @@
   <data name="CertificateStoreCommandDescription" xml:space="preserve">
     <value>Use Windows Certificate Store or a local certificate file.</value>
   </data>
+  <data name="CertificateExportPathOptionDescription" xml:space="preserve">
+    <value>Path to export the signing certificate to.</value>
+  </data>
   <data name="ClientIdOptionDescription" xml:space="preserve">
     <value>Client ID to authenticate to Azure.</value>
   </data>
diff --git a/src/Sign.Core/ISigner.cs b/src/Sign.Core/ISigner.cs
index 304a7afc..88cd7ff8 100644
--- a/src/Sign.Core/ISigner.cs
+++ b/src/Sign.Core/ISigner.cs
@@ -20,6 +20,7 @@ Task<int> SignAsync(
             Uri timestampUrl,
             int maxConcurrency,
             HashAlgorithmName fileHashAlgorithm,
-            HashAlgorithmName timestampHashAlgorithm);
+            HashAlgorithmName timestampHashAlgorithm,
+            string? certificateExportPath);
     }
-}
\ No newline at end of file
+}
diff --git a/src/Sign.Core/Signer.cs b/src/Sign.Core/Signer.cs
index 840c67a2..6ef5d36d 100644
--- a/src/Sign.Core/Signer.cs
+++ b/src/Sign.Core/Signer.cs
@@ -39,7 +39,8 @@ public async Task<int> SignAsync(
             Uri timestampUrl,
             int maxConcurrency,
             HashAlgorithmName fileHashAlgorithm,
-            HashAlgorithmName timestampHashAlgorithm)
+            HashAlgorithmName timestampHashAlgorithm,
+            string? certificateExportPath)
         {
             IAggregatingDataFormatSigner signer = _serviceProvider.GetRequiredService<IAggregatingDataFormatSigner>();
             IDirectoryService directoryService = _serviceProvider.GetRequiredService<IDirectoryService>();
@@ -76,6 +77,12 @@ public async Task<int> SignAsync(
             {
                 using (X509Certificate2 certificate = await certificateProvider.GetCertificateAsync())
                 {
+                    if (!string.IsNullOrWhiteSpace(certificateExportPath))
+                    {
+                        IExporter exporter = _serviceProvider.GetRequiredService<IExporter>();
+                        await exporter.ExportAsync(certificateExportPath);
+                    }
+
                     ICertificateVerifier certificateVerifier = _serviceProvider.GetRequiredService<ICertificateVerifier>();
 
                     certificateVerifier.Verify(certificate);
@@ -186,4 +193,4 @@ private static string ExpandFilePath(DirectoryInfo baseDirectory, string file)
             return file;
         }
     }
-}
\ No newline at end of file
+}
diff --git a/test/Sign.Cli.Test/TestInfrastructure/SignerSpy.cs b/test/Sign.Cli.Test/TestInfrastructure/SignerSpy.cs
index 083d4550..a572df9c 100644
--- a/test/Sign.Cli.Test/TestInfrastructure/SignerSpy.cs
+++ b/test/Sign.Cli.Test/TestInfrastructure/SignerSpy.cs
@@ -21,6 +21,7 @@ internal sealed class SignerSpy : ISigner
         internal int? MaxConcurrency { get; private set; }
         internal HashAlgorithmName? FileHashAlgorithm { get; private set; }
         internal HashAlgorithmName? TimestampHashAlgorithm { get; private set; }
+        internal string? CertificateExportPath { get; private set; }
         internal int ExitCode { get; }
 
         internal SignerSpy()
@@ -40,7 +41,8 @@ public Task<int> SignAsync(
             Uri timestampUrl,
             int maxConcurrency,
             HashAlgorithmName fileHashAlgorithm,
-            HashAlgorithmName timestampHashAlgorithm)
+            HashAlgorithmName timestampHashAlgorithm,
+            string? certificateExportPath)
         {
             InputFiles = inputFiles;
             OutputFile = outputFile;
@@ -54,8 +56,9 @@ public Task<int> SignAsync(
             MaxConcurrency = maxConcurrency;
             FileHashAlgorithm = fileHashAlgorithm;
             TimestampHashAlgorithm = timestampHashAlgorithm;
+            CertificateExportPath = certificateExportPath;
 
             return Task.FromResult(ExitCode);
         }
     }
-}
\ No newline at end of file
+}
diff --git a/test/Sign.Core.Test/SignerTests.cs b/test/Sign.Core.Test/SignerTests.cs
index 5de3769e..ae3a6afb 100644
--- a/test/Sign.Core.Test/SignerTests.cs
+++ b/test/Sign.Core.Test/SignerTests.cs
@@ -260,7 +260,8 @@ private async Task SignAsync(TemporaryDirectory temporaryDirectory, IReadOnlyLis
                 _certificatesFixture.TimestampServiceUrl,
                 maxConcurrency: 4,
                 HashAlgorithmName.SHA256,
-                HashAlgorithmName.SHA256);
+                HashAlgorithmName.SHA256,
+                null);
 
             Assert.Equal(ExitCode.Success, exitCode);
 
@@ -624,4 +625,4 @@ private static void RegisterSipsFromIniFile()
             Kernel32.LoadLibraryW($@"{baseDirectory}\mssign32.dll");
         }
     }
-}
\ No newline at end of file
+}