Impact of Root certificate Renewal

Question

I have generated a good number of leaf certificates with my root CA but now it(Root) has expired. Even though leaf certificates have a longer expiry date than root CA, they also expired due to expiration of Root CA. Do leaf certificates will still valid if I renew the Root CA with the same keys or Do I need to generate new leaf certificates again with renewed CA?

Answer 1

If you renew (same key, same name) the Root CA certificate then the leaf certificates will still validate. A certificate's identity is defined by its key and name, and if neither change then it's effectively the same certificate. All a renewal does is change the validity period of the original certificate.

Contrast the above with a re-key (new key, same name) where the identity has now changed and you'll need to resign the leaf certificates (or preferably just the online CA you have in place for these sort of situations).

Answer 2

In most cases, the CA will have issued a cross-signed certificate with a longer expiration date. Most modern web browsers will have the cross-signed certificate in their certificate store, and will chain back to the cross-signed certificate instead of the expired root certificate, if the browser finds that the original root certificate has expired. See https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 for more info.

However, some devices (e.g. IoT devices) which are not easily updated may not have the cross-signed certificate. In these cases, the certificate check may fail, due to the expired root certificate. If you know that your server is being accessed by clients that have not been not updated with cross-signed certificates, then you may want to replace your leaf certificates with ones that chain to non-expired root certificates. Most CA's issue replacement certificates free of charge, with the same expiration as the certificates being replaced.