FortiWeb 6.4.0 - exporting private key

[m0gg]

Hi,

Long story short:

I have created CSR on Fortiweb, CSR was signed and cerficate was imported on FortiWeb

My question is:

Is it possible to export private key and import it to the backend server? 

The probilem I see here is:

Private key is password encrypted (duh?), but there is no option to specify password during CSR creation, so I guess the password is automatically generated during CSR creation. I tried changing the password in CLI:

conf sys cert local

edit "cert1"

unset passwd

set passwd somepassword

end

but I get an error:

Command fail. The configuration of a certificate can not be changed from CLI except the comments.

Am I missing something here? Or this is just not possible?

[ddsouza_FTNT · Accepted solution]

It is not possible to export the unencrypted private key from Frotiweb for security reasons. 

[erickmiller]

"security reasons"...  ugh.  Thank you for protecting us from ourselves. :(

[xsilver_FTNT]

What's FortiWEB ?
It IS a front line of defense. Perimeter device.
Do you really want to keep private keys stored on such production unit forever ?

Available for anyone who get access to the unit either by mistake of by force ?
I definitely do not consider this as secure approach.

IF you really do want to generate cert right from unit, then download keys and simply STORE them outside in some safe! Should not be a problem.

A better approach from my point of view is to generate cert and keys on some CA (Certificate Authority you have) which is actually out of band. Shielded and securely placed in management subnet. And so keys are safe there.