Migrate kepairs

(Optional) Remove keypairs from Teams - Required only if the Teams feature is enabled; sets keypairs to open so they can be exported.

Request export - The requester submits export requests for all keypairs listed in the input CSV.

Approve export - A different admin approves the pending export requests.

Download keys - The requester downloads the encrypted private keys and their one-time passphrases.

Import keypairs - The importer loads the keypairs into the target Software Trust Manager environment.

Request export (Requester)

The user initiating the keypair migration from the source environment can initiate the keypair migration process by using this script.

For each keypair listed in the input CSV, the script submits an export request to the DigiCert Software Trust Manager API. Each request generates a unique export request ID, which is required for the approval step before the keypair can be exported.

Command:

.\1_request_export.ps1 `
    -InputCsv keypairs.csv `
    -BaseUrl "https://clientauth.dcone.cluster.local" `
    -AccountId "06ef4889-f2c7-4b28-9789-dba19355dccf" `
    -ApiKey "<requester-api-key>" `
    -ClientCert "C:\path\to\requester_cert.p12" `
    -ClientCertPass "<p12-password>"

Expected output:

═══════════════════════════════════════════════════════════════
 Step 1: Requesting Keypair Export
 Account: 06ef4889-f2c7-4b28-9789-dba19355dccf
 Input:   keypairs.csv
═══════════════════════════════════════════════════════════════

[2] Requesting export for: my-signing-key (5057601f-bc10-4289-bfa3-5d5c075efccd)
    ✓ Success — export_request_id: 37be73ae-1c1c-4b02-9530-e04ff7ec47de

═══════════════════════════════════════════════════════════════
 Done! Success: 1 | Failed: 0
 Output written to: output_export_requests.csv
 Share this file with the approver for step 2.
═══════════════════════════════════════════════════════════════

The generated output file output_export_requests.csv file is shared with the approver for the next step in the migration workflow.

Approve export (Approver)

Use this script to approve pending keypair export requests. A different administrator in the same source account must perform this step; the user who initiated the export request cannot approve it. The script reads the export request IDs from the input CSV and approves each request, enforcing Software Trust Manager's two-person authorization model for secure keypair export.

Command:

.\2_approve_export.ps1 `
    -InputCsv output_export_requests.csv `
    -BaseUrl "https://clientauth.dcone.cluster.local" `
    -AccountId "06ef4889-f2c7-4b28-9789-dba19355dccf" `
    -ApiKey "<approver-api-key>" `
    -ClientCert "C:\path\to\approver_cert.p12" `
    -ClientCertPass "<p12-password>"

Expected output:

═══════════════════════════════════════════════════════════════
 Step 2: Approving Keypair Export Requests
 Account: 06ef4889-f2c7-4b28-9789-dba19355dccf
 Input:   output_export_requests.csv
═══════════════════════════════════════════════════════════════

[2] Approving export for: my-signing-key (export_request_id: 37be73ae-...)
    ✓ Approved

═══════════════════════════════════════════════════════════════
 Done! Approved: 1 | Failed: 0
 Output written to: output_approved.csv
 Share this file with the requester for step 3 (download).
═══════════════════════════════════════════════════════════════

The generated output_approved.csv file is returned to the requester for the next step in the migration workflow.

Download keys (Requester)

Use this script to download approved keypairs. The original requester downloads the encrypted private key and one-time passphrase for each approved export. The script then generates a CSV containing all the information required to import the keypairs into the target Software Trust Manager environment.

Command:

.\3_download_keys.ps1 `
    -InputCsv output_approved.csv `
    -BaseUrl "https://clientauth.dcone.cluster.local" `
    -AccountId "06ef4889-f2c7-4b28-9789-dba19355dccf" `
    -ApiKey "<requester-api-key>" `
    -ClientCert "C:\path\to\requester_cert.p12" `
    -ClientCertPass "<p12-password>"

Expected output:

═══════════════════════════════════════════════════════════════
 Step 3: Downloading Exported Private Keys
 Account: 06ef4889-f2c7-4b28-9789-dba19355dccf
 Input:   output_approved.csv
═══════════════════════════════════════════════════════════════

[2] Downloading key for: my-signing-key (export_request_id: 37be73ae-...)
    ✓ Downloaded successfully (password obtained)

═══════════════════════════════════════════════════════════════
 Done! Downloaded: 1 | Failed: 0
 Output written to: output_download.csv
 Share this file with the importer for step 4.
═══════════════════════════════════════════════════════════════

Import keypairs (importer)

Use this script to import keypairs into the target environment. The user in the target Software Trust Manager environment imports the downloaded keypairs using the CSV generated in the previous step. Each keypair is imported with its original alias and algorithm.

Command:

.\4_import_keypairs.ps1 `
    -InputCsv output_download.csv `
    -BaseUrl "https://clientauth.one.stage.az.digicert.net" `
    -AccountId "c5cb5795-c500-4d74-a632-190875de8364" `
    -ApiKey "<target-user-api-key>" `
    -ClientCert "C:\path\to\target_cert.p12" `
    -ClientCertPass "<p12-password>"

Expected output:

═══════════════════════════════════════════════════════════════
 Step 4: Importing Keypairs into Target Environment
 Target Account: c5cb5795-c500-4d74-a632-190875de8364
 Target URL:     https://clientauth.one.stage.az.digicert.net
 Input:          output_download.csv
═══════════════════════════════════════════════════════════════

[2] Importing keypair: my-signing-key (algorithm: RSA)
    ✓ Imported successfully — new keypair ID: 4d38a9f5-6162-4759-948d-65cc0a3e4225

═══════════════════════════════════════════════════════════════
 Done! Imported: 1 | Failed: 0
═══════════════════════════════════════════════════════════════

Request export (Requester)

The user initiating the keypair migration from the source environment can initiate the keypair migration process by using this script.

For each keypair listed in the input CSV, the script submits an export request to the DigiCert Software Trust Manager API. Each request generates a unique export request ID, which is required for the approval step before the keypair can be exported.

Command:

./1_request_export.sh \
    --input keypairs.csv \
    --base-url https://clientauth.<your-source-host> \
    --account-id <source-account-id> \
    --api-key <requester-api-key> \
    --client-cert /path/to/requester_cert.p12 \
    --client-cert-pass <p12-password>

Expected output: Creates output_export_requests.csvcontaining:

keypair_alias,keypair_id,algorithm,export_request_id
my-signing-key,5057601f-...,RSA,37be73ae-1c1c-4b02-9530-e04ff7ec47de

The generated output file output_export_requests.csv file is shared with the approver for the next step in the migration workflow.

Approve export (Approver)

Use this script to approve pending keypair export requests. A different administrator in the same source account must perform this step; the user who initiated the export request cannot approve it. The script reads the export request IDs from the input CSV and approves each request, enforcing Software Trust Manager's two-person authorization model for secure keypair export.

Command:

./2_approve_export.sh \
    --input output_export_requests.csv \
    --base-url https://clientauth.<your-source-host> \
    --account-id <source-account-id> \
    --api-key <approver-api-key> \
    --client-cert /path/to/approver_cert.p12 \
    --client-cert-pass <p12-password>

Expected output: Creates output_approved.csvcontaining:

keypair_alias,keypair_id,algorithm,export_request_id,approval_status
my-signing-key,5057601f-...,RSA,37be73ae-...,APPROVED

The generated output_approved.csv file is returned to the requester for the next step in the migration workflow.

Download keys (Requester)

Use this script to download approved keypairs. The original requester downloads the encrypted private key and one-time passphrase for each approved export. The script then generates a CSV containing all the information required to import the keypairs into the target Software Trust Manager environment.

Command

./3_download_keys.sh \
    --input output_approved.csv \
    --base-url https://clientauth.<your-source-host> \
    --account-id <source-account-id> \
    --api-key <requester-api-key> \
    --client-cert /path/to/requester_cert.p12 \
    --client-cert-pass <p12-password>

Expected output: Creates output_download.csv containing:

keypair_alias,keypair_id,algorithm,export_request_id,private_key_base64,passphrase
my-signing-key,5057601f-...,RSA,37be73ae-...,LS0tLS1CRUdJ...,88rjLB6Bh00M6eK

Import keypairs (importer)

Use this script to import keypairs into the target environment. The user in the target Software Trust Manager environment imports the downloaded keypairs using the CSV generated in the previous step. Each keypair is imported with its original alias and algorithm.

Command:

./4_import_keypairs.sh \
    --input output_download.csv \
    --base-url https://clientauth.<your-target-host> \
    --account-id <target-account-id> \
    --api-key <importer-api-key> \
    --client-cert /path/to/importer_cert.p12 \
    --client-cert-pass <p12-password>

Expected output:

═══════════════════════════════════════════════════════════════
 Step 4: Importing Keypairs into Target Environment
 Target Account: c5cb5795-c500-4d74-a632-190875de8364
 Target URL:     https://clientauth.one.stage.az.digicert.net
 Input:          output_download.csv
═══════════════════════════════════════════════════════════════

[2] Importing keypair: my-signing-key (algorithm: RSA)
    ✓ Imported successfully — new keypair ID: 4d38a9f5-6162-4759-948d-65cc0a3e4225

═══════════════════════════════════════════════════════════════
 Done! Imported: 1  Failed: 0
═══════════════════════════════════════════════════════════════