title: Encryption of private key in centralized PKI with bouncycastle
body: <p>I'm writing a CMP server and I have a problem.
  It is used in a centralized PKI where the RA send a private key with the associated certificate to the server, that we have to relay to the CMP client.</p>
  
  <p>The problem is that I can't find how we are supposed to encrypt the private key to send it to the client and for him to be able to decrypt it.
  Do we only rely on the security of https, because it sounds wrong ?
  Did I miss something in the CRMF RFC ?</p>
  
  <p>A solution would be, I guess, to generate a temporary keypair from the client and use it for encryption/decryption but is sounds more like a hack than the way to do it properly.</p>
  
  <p>It is easy to do when the client is the one generating his keypair, but in this specific case, everything is generated by our OpenTrust RA.</p>