This article describes a scenario where the customer needs to load a local certificate into the configuration using a command which requires access to the private key. The customer is inquiring whether it's possible to load the certificate directly from PKI storage or into the "grpc ssl" section instead.

• The user needs to load a "local_certificate" into the configuration using the command set security certificates local <certname> load-key-file <key-file-name>, which requires a private key. 
• The private key is stored in /var/db/certs/common/keypair/<certificate-id>.priv, but it is only accessible by root and in DER format. 
• The customer is asking if there is a way to load the certificate directly from PKI storage (using show security pki local-certificate certificate-id <certificate-id>) or if it can be loaded directly into the "grpc ssl" section.

The issue was that the customer could not load a certificate from this PKI in the GRPC part of the config.

Adding the "use-pki" knob solved the issue:

root@sw# set system services extension-service request-response grpc ssl use-pki local-certificate <certificate_id>

• use-pki: Use the Public Key Infrastructure (PKI) database on the device for gRPC-based operations that require certificates.

system services extension-service request-response grpc