NW6SP5, edir 8.7.3

I am trying to export user certificates with private keys for users located in Organisation Unit containers so they can use C2S VPN (cert authentication) but consoleone (1.3.6c) and imanager (2.0.1) do not give the option to export private key. I end up with a .der cert with no key rather than .pfx cert with key

Private key status for the user certificates is 'present'

Export of private key works perfectly for users in Organisation container - such as admin

Ideas anyone ?