When a local root CA is created on FortiAuthenticator, the option to export the key and certificate is not available, however the option to export…

The private key of a root Certificate Authority (CA) is the most critical component in a Public Key Infrastructure (PKI). It is used to sign all certificates issued by that CA, establishing a chain of trust. For security reasons, the FortiAuthenticator is designed to never allow the export of the root CA's private key. Exposing this key would compromise the entire PKI, as an attacker could use it to issue fraudulent certificates. Therefore, the design principle is that there should be no legitimate reason to export the private key from the secure appliance where it was generated.

A. A CA, by definition, requires a public/private key pair to function. The private key is essential for signing certificates and Certificate Revocation Lists (CRLs).

B. OCSP is a protocol for checking certificate revocation status, not for key retrieval. The inability to export the key is a security design choice, not a function of OCSP.

D. A public key certificate (X.509) contains the subject's public key, issuer information, and the issuer's digital signature. It never contains the private key.

1. FortiAuthenticator 6.4.0 Administration Guide

Page 138

"Certificate Management > Certificate Authorities > Local CAs":

"The private key is generated on the FortiAuthenticator and cannot be exported. This is for security reasons

as there should never be a need to export the private key." This statement directly confirms that option C is the correct reason.