Exporting private key & public certificate

[NicolasBedard_]

Hi,

We have two SA-4500 in two different Data-Center with different IP addressing. But we're loadbalencing with the same public URL.

I dont know how to export the private key from our primary SA to be able to upload our public certificate on the second SA.

It that something possible ?

Do I need to buy one certificate per SA from Entrust ?

Thanks !

[123go_ · Accepted solution]

You can export the cert+private key by doing an export of the system config (system.cfg)

then import to your second SA, choosing following options when doing the import:

x Import Device Certificate(s)?

and

o Import only Device Certificate(s)

That is, assuming the devices are not FIPS models, in which case this procedure would not work (as the private key is held in the Hardware Security Module (FIPS) and cannot be extracted) so in that case you would have to request a new certificate.

[Markus_Z_]

So there's no way of exporting the private key otherwise? I mean, unless one would just generate the key/cert via openssl in the first place and then import into the ive?

That's kind of a bummer, when you need the private key for something else than importing it into another ive. Could you please confirm that there's no way of exporting the private key into a plain .pem formatted text file?

In case if you're wondering why one would need the private key anyway, I would say for example when you want to do WAN acceleration of SSL traffic to the admin gui, you'd have to import the private key into the wan optimizer.