FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I manage Private Keys separately (Private Key Library)? ​

Short answer

Yes. On the Certificates & PKI → Private Key Library screen, a key can be generated (RSA 2048/3072/4096, ECDSA P-256/P-384), a key in PEM format can be imported, or the key of an uploaded certificate can be taken into the library with the Take the key into the library operation in the certificate list (Private Key Library). The key in the library is selected with Use a key from the library while a new request is being opened in the CSR (External CA) tab; this way, re-signed certificates carry the same public key and clients that pin the key continue to work. The key content is not shown on any screen and cannot be exported in raw form.

Problem: The Public Key Changes When the Certificate Is Renewed ​

Every certificate obtained with a new signing request carries a new key. Mobile applications and API clients that pin the public key do not recognize this new key after the renewal and reject the connection. The key must be stored independently of the certificate and must be reusable in subsequent requests.

Solution: Three Methods ​

All three methods add a key to the library; the difference is where the key comes from. The added key is selected in subsequent CSR requests (Can I create a CSR on TR7?).

Your situationSuitable method
A new key is to be generated on TR7Method 1: Generate a new key
A key I have is to be put into the libraryMethod 2: Import an existing key
The key of an uploaded certificate is to be used in subsequent renewals as wellMethod 3: Take the key into the library
  • How it works TR7 generates a new private key in the selected algorithm and stores it in the library; the key does not leave the device.
  • Where it is openedCertificates & PKI → Private Key Library → Add → How to Add = Generate a new key
  • Requirement None
  • Scope CSR (External CA) requests

Step-by-Step Configuration ​

1
Adım 1 Open the add form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → Private Key Library screen, Add is clicked (how to add).

2
Adım 2 Select the name and the method

Key Name is entered; in the How to Add field, the default Generate a new key is left.

3
Adım 3 Select the algorithm

In the Key Algorithm field, RSA 2048 (default), RSA 3072, RSA 4096, ECDSA P-256 or ECDSA P-384 is selected.

4
Adım 4 Save

Add is clicked; the key is added to the list with the Generated Here source. In a cluster setup, with the default auto-sync, the record is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification ​

1LibraryPrivate Key Library list

The new key appears in the list with its algorithm, source and public key fingerprint.

ExpectedKey Algorithm · Source: Generated Here · Public Key Fingerprint

Method 2: Import an Existing Key ​

  • How it works The PEM key at hand is imported into the library; after it is saved, its content is not shown.
  • Where it is openedCertificates & PKI → Private Key Library → Add → How to Add = Import an existing key
  • Requirement A private key in PEM format
  • Scope CSR (External CA) requests

Step-by-Step Configuration ​

1
Adım 1 Open the add form

On the Certificates & PKI → Private Key Library screen, Add is clicked.

2
Adım 2 Select the name and the method

Key Name is entered; in the How to Add field, Import an existing key is selected.

3
Adım 3 Paste the key

The key is pasted into the Private Key (PEM) field; if the key has a passphrase, the passphrase is entered in the Key Passphrase (if encrypted) field.

4
Adım 4 Save

Add is clicked; the key is added to the list with the Imported source.

Verification ​

1FingerprintPrivate Key Library list

In the list, the full value is read by hovering over the Public Key Fingerprint cell; it is compared with the value calculated from the key.

Command: openssl pkey -in key.pem -pubout -outform DER | openssl dgst -sha256

ExpectedThe two SHA-256 values are the same

Method 3: Take the Key into the Library ​

  • How it works The key of an uploaded certificate is moved to the library and the certificate record refers to the key from there; the certificate presented does not change.
  • Where it is openedCertificates & PKI → SSL/TLS Certificates → right-click on the certificate → Take the key into the library
  • Requirement A certificate record that carries its key inside itself and is not yet bound to the library
  • Scope Subsequent CSR (External CA) requests

Step-by-Step Configuration ​

1
Adım 1 Open the certificate list

The Certificates & PKI → SSL/TLS Certificates screen is opened.

2
Adım 2 Select the operation

The certificate row is right-clicked and Take the key into the library is selected from the menu (right-click menu). The option appears only on certificates whose key is kept inside the record.

3
Adım 3 Confirm

The confirmation window that opens is accepted; the key is added to the library with the name <certificate name> — key (if the name is in use, (2), (3) … is added to the end) and appears in the list with the Taken from a Certificate source.

Verification ​

1Library and certificateTR7 side

In the Private Key Library list, the Taken from column of the new record shows the source certificate; Take the key into the library no longer appears in the right-click menu of the certificate.

ExpectedSource: Taken from a Certificate
The certificate presented on the vServices does not change; the openssl s_client output is the same as before the operation.

Common Mistakes ​

  • Looking for the library key in the Manual or PFX form. The library key is selected only with Use a key from the library in the Private Key field while a new request is being opened in the CSR (External CA) tab (scope and limits).
  • Expecting to export the key. The key in the library does not leave the device in raw form; it is downloaded only together with its certificate, inside a PFX, if Allow Download is on for the certificate. In the edit form, only Key Name can be changed.
  • Deleting a key that is in use. The deletion confirmation does not show the usage locations; the certificates bound to the key are left without a key and cannot be presented on the vService. Before deleting, the Used in tab in the preview is checked (Delete).
  • Thinking that the key must be taken into the library for an existing certificate to be re-signed. In a re-signing over the same record (Re-issue in the CSR tab, or Upload a re-signed certificate in the right-click menu of the certificate list), the key is already preserved; the library is needed when a new request is to be opened with the same key.

How it is done in the documentation

Related questions