Cisco ASA - Idenitiy certificate

Mohammed Shafiq · ‎11-29-2015

I am doing a hardware upgrade of a ASA. I want to export the existing device identity certificate to the new device. After I have completed the export. Does the old device retain the certificate in case I need to regress the upgrade for whatever reason?

Marvin Rhoads · ‎11-29-2015

Yes it stays on the source ASA - just like any other setting or file.

We typically need to get certificates re-issued vs. export/import though. This is because a certificate is only valid if the associated private key is on the device. Unless you marked the RSA private key as exportable when you created it to support the original certificate signing request, you cannot simply move the .cer file around to different devices.