Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
m0gg
New Contributor

FortiWeb 6.4.0 - exporting private key

Hi,

 

Long story short:

I have created CSR on Fortiweb, CSR was signed and cerficate was imported on FortiWeb

 

My question is:

Is it possible to export private key and import it to the backend server? 

 

The probilem I see here is:

Private key is password encrypted (duh?), but there is no option to specify password during CSR creation, so I guess the password is automatically generated during CSR creation. I tried changing the password in CLI:

conf sys cert local

edit "cert1"

unset passwd

set passwd somepassword

end

but I get an error:

Command fail. The configuration of a certificate can not be changed from CLI except the comments.

 

Am I missing something here? Or this is just not possible?

 

1 Solution
ddsouza_FTNT
Staff
Staff

It is not possible to export the unencrypted private key from Frotiweb for security reasons. 

View solution in original post

3 REPLIES 3
ddsouza_FTNT
Staff
Staff

It is not possible to export the unencrypted private key from Frotiweb for security reasons. 

erickmiller

"security reasons"...  ugh.  Thank you for protecting us from ourselves. :(

xsilver_FTNT

What's FortiWEB ?
It IS a front line of defense. Perimeter device.
Do you really want to keep private keys stored on such production unit forever ?

Available for anyone who get access to the unit either by mistake of by force ?
I definitely do not consider this as secure approach.

IF you really do want to generate cert right from unit, then download keys and simply STORE them outside in some safe! Should not be a problem.

A better approach from my point of view is to generate cert and keys on some CA (Certificate Authority you have) which is actually out of band. Shielded and securely placed in management subnet. And so keys are safe there.

 

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Labels
Top Kudoed Authors