private-encryption-key

When private encryption is enabled (see system encryption-method), FortiWeb generates a private key to secure sensitive configurations. If private encryption is disabled and later re-enabled, a new private key is generated, which can cause backup configurations encrypted with the previous key to become unusable.

To troubleshoot such scenarios, use the execute private-encryption-key sample command to generate a base64-encoded clear text string and its HMAC signature encrypted with the current private key. Before any private key changes, users should generate and record this sample for future verification.

If a backup configuration fails to restore, the execute private-encryption-key verify command can be used to check whether the stored sample still matches the current private key. A failed verification indicates that a new private key was generated, confirming that the original key is no longer in use. If the verification passes, the private key remains unchanged.

Syntax

execute private-encryption-key sample

execute private-encryption-key verify <sample>

Variable	Description	Default
sample	Generate a base64-encoded clear text string and its HMAC signature encrypted using the private key.	No default.
verify <sample>	Verify the HMAC signature of the provided base64-encoded clear text using the private key. Use the sample generated by execute private-encryption-key sample.	No default.

Example

# execute private-encryption-key sample
B64TEXT: ec1d9EtAaX7ZHl6CBihdb4/8QdqgjWZwkrEqqJYswbk=
B64HMAC: hDYGL62rIeg4NuspIAt2Pd8thrE=

# execute private-encryption-key verify ec1d9EtAaX7ZHl6CBihdb4/8QdqgjWZwkrEqqJYswbk= hDYGL62rIeg4NuspIAt2Pd8thrEa
Verification failed.

Related topics

system encryption-method