Download private key from crypto token

[sharbich]

Hello, I cannot download the private key of my CA using the following command:
ejbca.sh ca exportca HarbichCA HarbichCA.p12
I selected the crypto token in the menu for soft crypto tokens in the admin interface -> crypto tokens, switched to edit mode, checked the box "Allow export of private keys" and saved. However, this is not being adopted. Why?

Greetings from Stefan Harbich

[primetomas]

The command is names exportca because it is for CAs, not crypto tokens. You'll create a CA using a crypto token and then the exported P12 will be containing the keys that the CA is configured to use.
Crypto Tokens as such can unfortunately only be fully exported with ConfigDump.

[sharbich]

root@dsme01:/opt/ejbca/bin# ./ejbca.sh ca exportca HarbichCA HarbichCA.p12
Setting SignatureKeyAlias to SignatureKeyAlias
Setting EncryptionKeyAlias to EncryptionKeyAlias
Enter keystore password:

Exception in thread "main" javax.ejb.EJBException: org.cesecore.keys.token.CryptoTokenAuthenticationFailedException: PKCS12 key store mac invalid - wrong password or corrupted file.
Unfortunately, I don't know the password anymore. Can I read the password?

[sharbich]

I only want to export the CA's public and private key?

[primetomas]

Aha, I see that you have auto-activation enabled right? In that case the password is stored in the database, but encrypted. It is a bit of work to try to decrypt that, but it is possible.

[sharbich]

It is a bit of work to try to decrypt that, but it is possible.
Can you give me a tip how I can decrypt the password?

[sharbich]

I see in the ejbca.properties the folling entry "ca.cmskeystorepass=. Is this the keystore password?

[sharbich]

I'm happy. I found the password in the "cesecore.properties" file. How can I change the password?

[primetomas]

You can change crypto token password in the UI or using the CLI.
bin/ejbca.sh cryptotoken setpin --help