> # Exporting and Importing Identity Information in PKCS#12 Format

> You can export the identity certificate along with the RSA key pair and CA certificate (or the entire chain in the case of a subordinate CA) of a trust point to a PKCS#12 file for backup purposes. You can later import the certificate and RSA key pair to recover from a system crash on your switch or when you replace the supervisor modules.

> Note Only the bootflash:filename format local syntax is supported when specifying the export and import URL.

> ## Detailed Steps

> To export a certificate and key pair to a PKCS#12-formatted file, follow these steps:

> 1. Expand Switches > Security, and then select PKI in the Physical Attributes pane.
> 2. Click the Trust Point Actions tab in the Information Pane .
> 3. Select the pkcs12export option in the Command drop-down menu to export the key pair, identity certificate, and the CA certificate or certificate chain in PKCS#12 format from the selected trust point.

> 4. Enter the output file name as bootflash:filename to store the exported PKCS#12 identity.
> 5. Enter the required password. The password is set for encoding the PKCS#12 data. On successful completion, the exported data is available in bootflash in the specified file.
> 6. Click Apply Changes to save the changes.

> To import a certificate and key pair formatted as a PKCS#12 formatted file, follow these steps:

> 1. Expand Switches > Security, and then select PKI in the Physical Attributes pane.
> 2. Click the Trust Point Actions tab in the Information pane.
> 3. Select the pkcs12import option from the Command drop-down menu to import the key-pair, identity certificate, and the CA certificate or certificate chain in the PKCS#12 format to the selected trust point.
> 4. Enter the input in the bootflash:filename format containing the PKCS#12 identity.
> 5. Enter the required password. The password is set for decoding the PKCS#12 data. On completion, the imported data is available in bootflash in the specified file.
> 6. Click Apply Changes to save the changes.

> On completion the trust point is created in the RSA key-pair table corresponding to the imported key pair. The certificate information is updated in the trust point.

> Note The trust point must be empty (with no RSA key pair associated with it and no CA is associated with it using CA authentication) for the PKCS#12 file import to succeed.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.