Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying very hard to get away from a set of Kemp Loadmasters that I bought years ago to provide HA access to our website. Part of that process is going to be putting the key and certificate in the new solution (HAproxy with nginx doing SSL). Unfortunately, I've come up against a problem...

The Kemp has built-in certificate management, and it generates CSR's at the touch of a button. It also supported importing of signed certificates, however it does not, so far as I can tell, allow any kind of export of the key itself.

There is a "backup key and certificates" ability, however here's the text from the manual:

LoadMaster supports exporting of ALL certificate information.  
This includes private key, host and intermediate certificates.  
The export file is designed to be used for import into another 
LoadMaster and is encrypted.  Export and import can be completed 
using the WUI at Certificates -> Backup/Restore Certs.  Please 
make sure to note the pass phrase used to create the export, it 
will be required to complete the import. 

You can selectively resort only Virtual Service certificates 
including private keys, intermediate certificates or both.

Well, that is great, but as for actually DEALING with the certs, I'm apparently out of luck.

Of course, I'm not going to give up that easily. I ran "file" on the saved cert bundle and got this:

$ file client1.certs.backup 
 client1.certs.backup: gzip compressed data, from Unix

Well, awesome, I thought. Maybe it's just a .tar.gz, so I unzipped it, and that went fine, but my attempts to untar it didn't work, and running "file" on it now just gives this:

$ file client1.certs.backup 
client1.certs.backup: data

So that's where I'm stuck. Anyone have experience with these?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Had the same problem, I took a blind guess that maybe it was encrypted with a symmetric openssl cipher.

Running: openssl enc -d -aes-256-cbc -in CertBackup > CertBackup.tar

And then entering my key store password worked, generating a tar file of all the certs and keys.

Why they would gzip the file after they encrypted it is beyond me...

share|improve this answer
    
wow, excellent sleuthing! I don't work there anymore, but I've passed your answer along to them. They're looking forward to getting rid of those machines ASAP. Thanks very much! –  Matt Simmons Aug 2 '11 at 3:17
add comment

Try peeking at the file with od -c client1.certs.backup | less to see if there is an obvious format that file isn't recognizing due to a prepended header. Another option would be to try strings client1.certs.backup | less to view the printable strings in the file.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.