How to Export the Embedded Serv-U SSH Fingerprint Key to a New Serv-U Server

An SSH Fingerprint Key is a short, unique identifier for an SSH server’s cryptographic host key. 
When a user connects to an SSH server for the first time, the SSH client displays its fingerprint and asks if the user trusts it.
This process helps prevent man-in-the-middle attacks by ensuring the server’s identity is verified.

SolarWinds Serv-U uses an SSH Fingerprint Key to secure SFTP/SSH connections.
During installation, the application automatically generates an embedded or default fingerprint key.
This key becomes part of the server’s identity.
However, during a server migration, this identity may change if a different fingerprint key is used, causing clients to receive security warnings about a potential server identity mismatch.

If a Serv-U server uses a custom-created SSH Fingerprint Key, migration is relatively simple—users can export the key, import it to the new server, and reselect it by entering the key password.
In contrast, migrating the default or embedded SSH Fingerprint Key is more challenging, as it is tied to the original installation.
This article explains how to export and import the default or embedded Serv-U SSH Fingerprint Key to preserve the server’s identity and prevent connection warnings during migration.

1. Remote on the original Serv-U Server
2. Open the MMC.exe as an admin > File > Add/Remove Snap-in
3. Add the Certificate to the Snap-in > Complete the Certificate Snap-in Windows > OK
   • When asked for Certificate Snap-in, select Computer Account > Next > Local Computer > Finish
   • 
   • 
   • 
4. Navigate to Console Root > Certificate > Personal > Certificates
5. Under the "Issued To" column, look for ftp.Serv-U.com
   •  
6. Double-click the ftp.Serv-U.com to open the Certificate Window and go to the Details Tab > Select Copy to File > Ok
   • 
7. Complete the Export Wizard
   1.  
   2.  
   3.  
   4. Set a Password and make sure to take note of the created Password as it will be used later.
      •  
   5. Browse where to save the PFX file and create a name for the PFX Certificate
      
      •  
   6.  
8. The next step is to extract the KEY file from the Exported PFX file. These steps require an SSL server.
   1. Follow this article for the next steps: Extract SSL certificate PFX file for Serv-U 
   2. As described in the article, install OpenSSL on a server or PC and make it your SSL Server. You can download the "Win64 OpenSSL v3.5.2 Light" EXE or MSI to install on the Server.
   3. Copy the PFX file inside the C:\Program Files\OpenSSL-Win64\bin folder of the SSL Server.
   4. In the Windows command-line, navigate to the OpenSSL bin directory: C:\Program Files\OpenSSL-Win64\bin
   5. Run the following command to extract the Key File:

      • REM - Scripts are provided AS IS without warranty of any kind. SolarWinds further disclaims all warranties including, without limitation, any - implied warranties of merchantability or of fitness for a particular purpose.
        REM - The risk arising out of the use or performance of the scripts and documentation stays with you. 
        REM - In no event shall SolarWinds or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the scripts or documentation. 
        
        openssl pkcs12 -in yourpfxname.pfx -nocerts -out yourpfxKEYname.key

9. Access the New Serv-U Server
10. Paste yourpfxKEYname.key on this new server. Make sure to save it in a Folder to which the Serv-U Service account has full access.
11. Open the Serv-U Manager Console.
12. Go to Domain > Limit&Settings > Encryption
13. Under SSH Private Key (for SFTP), click the Browse the Key File
14. Type in the Password created when exporting the PFX.
15. Click Save
16. The SSH Private Key (for SFTP) for the original Server and New Server should be the same now.
    •