IOS IPSEC with RSA-SIG - moving the CA to a new router

[kasper123]

We have a VPN running on cisco routers that uses RSA-SIG authentication.

One of the routers is the CA and it has issued certificates for itself and for the other router.

Now we are upgrading the CA router to a new 2911 router.

Is it possible to somehow move the CA from the current 2811 to the new 2911 router so that everything continues to work as it is?

[Marcin Latosiewicz]

There is a couple of thing to consider, like where you are storing your CRL etc. 

But in general you can follow this procedure: 

http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-124-mainline/82153-backup-restore-ios-ca.html

it's dated but close enough to today's syntax.