Firepower: exporting private key of Self-signed certificate

[cpaquet]

How can I download (export) the private key of the self-signed certificate created through Object > PKI > Internal CAs ?

The Firepower self-signed certificate is to be installed on corporate computers as Trusted Authority and used by FTD for outbound SSL decryption.  If so, the private key needs to be backup, but I can't find where.  Under Internal CAs, I see how to download the self-signed cert, but not how to export its key private.  

Thank you.

[Francesco Molino]

Hi

To do ssl decryption, on objects management window, under PKI/Internal CAs, generate a self signed CA and use it in your ssl policy.
What you need is to export this certificate and add it into your machine on the trusted CA vault. Private key isn't needed here.

[cpaquet]

Francesco, my post is mentioning the private key because we want to backup in case we need to restore FMC.  We know that the private key is not needed on workstation to perform SSL decrypt; that only the root cert of the signing authority of FMC identity cert needs to be installed on the certificate store of inside hosts (and in both stores:  default window store used by Chrome, IE, Edge, etc) and in Firefox cert store.)  Again, my question is: how do I export, for backup, the private key of a FMC Self-Signed certificate.

Regards.

[Francesco Molino]

Sorry, my bad I didn't understood your question.

So when you go into FMC, under objects/PKI/Internal CA, click on edit icon on your selfsigned Internal CA.

It will prompt you a password and export a p12 file.

Once you have the p12 file exported, run the following command:

openssl pkcs12 -info -in nameofyourexportedfile.p12 -nodes

This command will ask you to type in a password which is the one you typed in FMC at the export step. 

It will show you your certificate and private key. 

[cpaquet]

Thanks Francesco for the help. However, I dont get the result you are suggesting. 

When I got to FMC > Objects > Objects Management > PKI > Internal CAs and I edit the Self-Signed certificate. contrary to what you wrote, I am not "prompt you a password and export p12. "  When I click edit on the self-signed certificate, it just opens the Self-Signed cert where the only editable field is the Name of the object. All the other fields are none-editable. The only button is DOWNLOAD, which downloads the .p12 in the Download folder of the local computer from which FMC is being accessed.  I have attached the screen capture - no export functionality.

Question: are you sure that the step you are describing with the capabilities to export are available to self-signed certificates? Or wouldn't this functionality be reserved only to identity cert signed by a Trusted Authority?

Regards,

Cath.

[Francesco Molino]

Here is a self signed certificate that I can export without problem. 

I'm sorry to hear you can't do it.

[Mohammed al Baqari]

Hi,

If it you enabled exportable during the certificate generation then from
CLI you can do it as follow

crypto ca export pkcs12

**** please remember to rate useful posts

[cpaquet]

Mohammed, I'm on the PKI > Generate Internal Certificate Authority window, to generate a new Self-signed cert from FMC, but I don't see an option to make that cert / key pair exportable.  I have attached the screen capture.

[Marvin Rhoads · Accepted solution]

For self-signed certificates we don't have the option of either making the key exportable when creating them or exporting it later.

If it's a virtual FMC you can backup the entire VM from outside of FMC (e.g a VMware snapshot).

If you want just the key and certificate then don't use self-signed. Generate the key and csr externally using openssl (cli) or XCA (open source Windows GUI-based tool) and save the key and issued certificate from your internal CA using those tools.

[cpaquet]

Thank you Marvin for the straight answer.  Much appreciated.