Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background: I have my own authoritative certificate that I generated myself for signing certificates for services my friends and I use, including web server, ircd, etc. It's convenient because I don't have to spend money getting my certificate signed and among my those who use it, the guarantee of security is fairly complete.

Caveat: Being somewhat noobier then than I was now, I set my CA to expire after a year. This was about 10 months ago. The private key is 4096 bit RSA and the certificate is self signed with SHA512, so it should stay secure for pretty much as long as I'm around to care about it, as long as I don't lose the private key.

Question: I know I can generate a new certificate from the private key with a longer expiration date (say 100 years from now for the purposes of this discussion). Would the replacement be as simple a process as substituting the newly generated, extended certificate to all of the clients? Would they accept the subcertificates as trusted, provided they updated their stored copies of the CA to reflect the new expiration date? Would I be able to skip regenerating all of the intermediate certificates as long as the CA's keypair and fingerprint remained the same?

share|improve this question
It's more or less an academic issue because most of the subcertificates expire after one year as well, and I won't bother resigning the original private keys, I'll just generate new ones –  Wug Jul 17 '12 at 19:28

2 Answers 2

up vote 3 down vote accepted

You shouldn't have to reissue all of your certificates. Assuming that each is still valid, and as long as you use the exact same key and subject for your CA you should be able to extend the life of your CA and redistribute the certificate as the new trust anchor.

share|improve this answer
I was just about to come back and mention that I have forgotten to update the CA on my windows partition, so locally I still have the old one, but the new (extended) one is installed and working on the web server box. –  Wug Jul 17 '12 at 23:54

No, you are going to have to reissue/resign all the derived certificates and also distribute the new root certificate to every client that needs to trust it (preferably do this before the old certificate expired, so this can be done on the old certificate authorities chain of trust).

From http://www.debian-administration.org/articles/284:

Your certificate chain can break due to certificate expiry in two ways:

The certificates you signed with your root certificate have expired.

Your root certificate itself has expired.

In the second case, you have some work to do. A new root CA certificate must be created and distributed, and then your existing certificates must be recreated or re-signed.

In the first case, you have two options. You can either generate new certificate signing requests and sign them as described above, or (if you kept them) you can re-sign the original requests. In either case, the old certificates must be revoked, and then the new certificates signed and installed into your secure applications as described earlier.

You cannot issue two certificates with the same Common Name, which is why the expired certificates must be revoked. The certificate is in the newcerts directory; you can determine its filename by browsing index.txt and searching for the Common Name (CN) on it. The filename is the index plus the extension ".pem", for example "02.pem". To revoke a certificate:

openssl ca -revoke newcerts/02.pem -config ./openssl.cnf 
Using configuration from ./openssl.cnf 
Enter PEM pass phrase: demo 
Revoking Certificate 02. 
Data Base Updated 

Now that the certificate has been revoked, you can re-sign the original request, or create and sign a new one as described above.

share|improve this answer
I forgot to update the CA on one of my machines, and it accepts the updated CA (though all it has to verify is the old one). –  Wug Jul 17 '12 at 23:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.