Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a Private Key?
Short answer
In public key cryptography, keys are generated in pairs: the public key is shared with everyone and carried inside the certificate, while the private key stays only with its owner. Because a signature made with the private key can be verified with the public key, in the TLS handshake the server proves with the private key that the public key in the certificate belongs to it; anyone who obtains the private key can impersonate the server. In TR7, the private key is kept either inside the certificate record or in the Private Key Library; a key in the library does not leave the device in raw form; it is downloaded inside a PFX together with its certificate only if the Allow Download switch of the certificate is on.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → Private Key Library → Add | How to Add (Generate a new key, Import an existing key), Key Algorithm, Private Key (PEM), Key Passphrase (if encrypted) | Generating or importing a key |
| Private Key Library list and preview | Public Key Fingerprint | Identifying the public key of the key; the records that show the same value are the same key |
| Certificates & PKI → SSL/TLS Certificates → Manual | Key Content, Password | Uploading the private key of the certificate as PEM |
| SSL/TLS Certificates → right-click | Take the key into the library | Moving the key of the certificate to the Private Key Library |
| SSL/TLS Certificates → CSR (External CA) → Add | Private Key: Generate a new key for this request, Use a key from the library | Selecting the key with which the CSR will be signed |
Common Misconceptions
- "The private key is inside the certificate." The certificate carries only the public key; the private key is kept separately. In TR7, even though the two are stored in the same record, only the certificate is sent to the client.
- "A key in the Private Key Library can be downloaded." A key in the library is a record of which only the name can be changed; it is not exported in raw form; if the Allow Download switch of the certificate is on, it comes out inside a PFX together with its certificate.
- "When the certificate is renewed, the key has to change as well." If the CSR is signed again with the same library key, the new certificate carries the same public key (What is the difference between renewing a certificate and rekeying it?).
How it is done in the documentation
