---
title: "ezgh private-ca certificate export-key"
description: "Export a key EZGH generated, encrypted with your passphrase."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh private-ca certificate export-key

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh private-ca certificate export-key <id> [--out key.pem] [--passphrase-file f] [--certificate-out cert.pem] [flags]
```

Export the private key EZGH generated for a certificate, as encrypted PKCS#8 PEM (PBES2, AES-256-CBC, PBKDF2-SHA256): you need the passphrase to use it. The passphrase (12–1024 characters) comes from `--passphrase-file` (the file's content, less one trailing newline) or is typed twice on a terminal, used exactly as given either way; it's never a flag's value. `--out` writes the key to a new file (mode 0600), else it's printed on stdout; `--certificate-out` writes the certificate and its chain. Neither replaces a file, or follows a symlink, without `--force`. Both, and -o, are checked before anything is exported.

Exporting needs certificates.privateCertificates.exportKey, which no managed policy grants, and is recorded in Trails. EZGH keeps the key until `ezgh private-ca certificate forget-key`, the certificate is deleted, or 30 days after it expires. Certificates issued from a CSR have no key to export.

Part of [`ezgh private-ca certificate`](/cli/reference/private-ca-certificate).

## Examples

```sh
ezgh private-ca certificate export-key 019a1b2d-… --out key.pem --certificate-out cert.pem
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--certificate-out` | string |  | write the certificate and its chain to this new file |
| `--force` | boolean |  | replace `--out` and `--certificate-out` if they exist |
| `--out` | string |  | write the encrypted key to this file (mode 0600) |
| `--passphrase-file` | string |  | read the passphrase from this file, less one trailing newline (- for stdin) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/private-ca-certificate-export-key/index.mdx