Backing up the software encryption key

When you installed and configured Palo Alto Networks Trust Protection Foundation, you had the option to enable either software or hardware encryption (or both). If you enabled software encryption, you need to back up the software encryption key to a secure location. The software key is critical to the functionality of Trust Protection Foundation. Without it, you cannot access data in the database. In the event of a system failure, you will need a copy of the encryption key to access your data. Additionally, if you want to install additional Trust Protection Foundation servers, you will need the software key to install and configure those servers.

DID YOU KNOW?  How is the Palo Alto Networks Trust Protection Foundation software key used and why is it so important to back it up?

Trust Protection Foundation maintains all system information—that is, configuration settings, managed server and certificate information, archived certificates, and private keys—in a database. To secure this information, Trust Protection Foundation uses an AES-256 encryption key—the software key—to encrypt the connection to the database.

Depending on the encryption key selected in the object configuration, the objects themselves can be encrypted using the software key. The key is securely stored in the Windows registry.

For more information about why it's important to back up your data, see Disaster recovery operations.

To export the software key from Trust Protection Foundation Configuration Console

  1. From the Palo Alto Networks Trust Protection Foundation server, open Trust Protection Foundation Configuration Console.
  2. In the left panel, click Connectors.
  3. In the center panel, click the Software component.
  4. In the Actions panel on the right, click Export Key...
  5. (Conditional) If requested, enter the Palo Alto Networks Trust Protection Foundation administrator user name and password.
  6. Type a password to protect the exported key file. The password must meet the default global password rule for the Software Key Export type. For more information, see Global password rules.

    IMPORTANT  The password is saved exactly as you type it, including any spaces at the start or end. To import the key later, you must type exactly the same password.

For more information, see Trust Protection Foundation Configuration Console.

To export the software key from the command line

  1. On the Trust Protection Foundation server, open a command line and browse to the Palo Alto Networks installation directory.

  2. Run the following command:

    tppconfiguration.exe -keyexport:<file-path>

NOTE  The TppConfiguration.exe -keyexport command also checks the password against the default Software Key Export rule. If the password doesn't meet the rule, the command lists the requirements that aren't met and stops with an error.

Related Topics Link IconRelated Topics