How to Export a Certificate from SMA?

[anotthak8]

Hello,

I plan on uploading a new SHA-2 cert to our SMA and I am wondering how do I export the old cert (Should any error occur)?

I will be using the instructions in the link below to import a new cert. However, I do not see any instructions to export the old cert.

http://www.cisco.com/c/en/us/support/docs/security/content-security-management-appliance/118460-technote-sma-00.html#anc2

Thank you in advance!

[Libin Varghese · Accepted solution]

Hi,

You may use the certconfig CLI command to print the installed certificate, or download the SMA configuration file and get the certificate from the XML file.

Please make sure to export the configuration file with passwords unmasked.

Regards,
Libin Varghese

[dmccabej · Accepted solution]

Hello,

You can obtain the current certificate information via a configuration export. This can be done in the GUI via System Administration --> Configuration File --> Download configuration. (Be sure to uncheck mask passwords if you ever wish to re-import this exported configuration)

Once exported, you can search for the following lines for the certificate and private key information :

+++

-----BEGIN CERTIFICATE-----
xxxxx
-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----
xxxxx
-----END RSA PRIVATE KEY-----

+++

Thanks!

-Dennis M.

[thaungtunzaw]

Hello,

Please kindly advise how can I get the Private Key as it is not included in received the signed certificate.

-----BEGIN RSA PRIVATE KEY-----
xxxxx
-----END RSA PRIVATE KEY-----

Thanks

[dmccabej]

Hello,

Please review my previous response regarding the configuration export to obtain the private key. If the private key is not listed in the configuration, then either the certificate was not generated on the ESA, or the certificate was not saved (submit/commit) after it was generated. If the case is the latter, you would need to re-generate the certificate/CSR and re-send to your CA since the private key would be lost. 

Thanks!

-Dennis M.