I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site is signed by a CA (usually an intermediate CA who is itself signed by a root CA) and this public key/certificate tends to expire every 3-4 months.
What happens after it expires? Can you extend the validation period of the same public key or do you need to get a new one? I know some hosting providers such as Bluehost who say they extend the validation period automatically using the same public key, is this what usually happens?
If the intermediate CA gets compromised, would you be able to have the same public key simply signed by another intermediate CA and keep your site active?
For context, I'm looking to implement SSL pinning using the public key for my site and am wondering what the worse case scenarios could be if a CA in my site's chain gets compromised, or if at the end of my site's certificate, the public key is changed.
