Export a Certificate

Edit online

About this task

Use the manageKeyCerts -export command to export a certificate from the system store or the HSM. CM can be running when you run this command.

Consider the following before you use this command:

  • If you specify the engine parameter and the certificate is stored on the HSM, the certificate is exported from the HSM configured at the engine. If a netHSM is used and multiple engines can access it, any of the engines can be specified to export the certificate.
  • If you do not specify the engine parameter and the key certificate is stored in an HSM, the certificate is exported from the HSM configured for CM.
  • If the certificate is not stored on an HSM, the engine parameter is ignored and the certificate is exported from the Secure Proxy system certificate store.
  • For key certificates stored on the HSM, only the public certificate in PEM format will be exported. The private key cannot be exported.
To export a key certificate from the Secure Proxy system certificate store, type the following command: 
manageKeyCerts -export [parameters]

Following is a description of the export parameters:

Parameter

Description

certName

Name of the key certificate on Secure Proxy. Required.

certStore

Name of the system certificate store where the key certificate will be stored. This field is optional. Default=dfltKeyStore.

engine

Name of the engine with access to the HSM. Optional.

format

Format for the key certificate file. This parameter is required for non-HSM key certificates. Forced to pem for the HSM key certificates. Valid values = pem | pkcs12.

file

Fully-qualified path of the file where the key certificate file will be stored.

Required.

systempass

CM system passphrase.

adminid

Administrator ID. Optional. Prompts if not defined.

adminpass

Administrator password. Optional. Prompts if not defined.

pkcs12storepass

Password of the PKCS12 file, if the format is PKCS12 and the key certificate is not stored on an HSM. Optional. Prompts if not defined.

pkcs12keypass

Passphrase for the key in the PKCS12 file, if the format is PKCS12 and the key certificate is not stored on an HSM. Optional. Prompts if not defined.

pemkeypass

Passphrase to encrypt the private key if the format is PEM.