Private keys and CSRs must be generated on the appliance using Setup Tool or the certificate generation tool. However, you can copy private keys and CSRs from one SMA appliance to another using the procedure described in Managing Server Certificates in AMC. Any copied certificates are overwritten if you make changes to them in AMC.