If you use the SCP operational CLI command to export
a certificate and include its private key (
scp export certificate passphrase <phrase> remote-port <1-65536> to <destination> certificate-name <name> include-key <yes | no> format <der | pem | pkcs10 | pkcs12>
),
and if the certificate’s private key is blocked, the command fails
and returns an error message because you cannot export a blocked
private key.