# Obtain Private Key from generated CSR **URL:** \ **Category:** Ignition\ **Created:** [April 21, 2020, 1:03am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061 "2020-04-21T01:03:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Andrew.Zebic](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Andrew.Zebic](https://forum.inductiveautomation.com/u/Andrew.Zebic)\ **Post date:** [April 21, 2020, 1:03am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/1 "2020-04-21T01:03:27Z")
Hi, We’re running a setup where we have a main and backup gateway, and we want both gateways to have SSL encryption with the same certificate. I will need the private key that Ignition auto-generates to be installed on both the main and backup server. When ignition auto-generates a .csr it has a private key that it automatically generates along with. How can I get pull this from Ignition? Thanks, ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [April 21, 2020, 1:27am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/2 "2020-04-21T01:27:15Z")
Assuming you are on at least 8.0.3, if you want the same SSL certificate installed on both gateways, you should be able to simply copy the key store file `$GATEWAY1/webserver/ssl.pfx` over to `$GATEWAY2/webserver/ssl.pfx` (where `$GATEWAY1` and `$GATEWAY2` are the root installation directories on the hosts of your first and second gateways respectively) ---
**Author:** ![Andrew.Zebic](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Andrew.Zebic](https://forum.inductiveautomation.com/u/Andrew.Zebic)\ **Post date:** [April 21, 2020, 1:44am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/3 "2020-04-21T01:44:01Z")
Alright fair enough, since I’m on 8.0.9. Also I don’t have an ssl.pfx file in that location but csr.pfx instead. Same action but using that file instead? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [April 21, 2020, 1:54am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/4 "2020-04-21T01:54:11Z")
Have you exchanged your CSR for a CA-signed SSL certificate yet? If you have - once you install the certificate chain from the CA into one of the Gateways, the `ssl.pfx` key store should be generated for you ---
**Author:** ![Andrew.Zebic](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Andrew.Zebic](https://forum.inductiveautomation.com/u/Andrew.Zebic)\ **Post date:** [April 21, 2020, 2:07am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/5 "2020-04-21T02:07:57Z")
Ah right that gets it, I can see the ssl.pfx file now. That said though, this file swap by itself doesn’t install the SSL certificate. How do I go about getting the private key from this file since it requires a password to open? Otherwise I won’t be able to install the certificate on the gateway. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [April 21, 2020, 2:13am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/6 "2020-04-21T02:13:58Z")
I missed one important step - on the gateway that you copied the key store file to, you will need to tell it to refresh its key store from disk. You can do this one of a few ways: 1. every 15 mins or so, the system will automatically check for the presence of a new key store file and will hot-reload the SSL certificate 2. you can tell the gateway to reload the key store immediately by invoking the following GCU command: `gwcmd.sh --reloadks` (assuming a \*nix environment) 3. restart the gateway ---
**Author:** ![Andrew.Zebic](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Andrew.Zebic](https://forum.inductiveautomation.com/u/Andrew.Zebic)\ **Post date:** [April 21, 2020, 3:23am UTC](https://forum.inductiveautomation.com/t/obtain-private-key-from-generated-csr/34061/7 "2020-04-21T03:23:28Z")
Thank you very much, this has resolved the issue. Regards,