When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Question

Here is the scenario, just wanted confirmation that I am understanding it correctly.

I have a TLS certificate that will expire soon;

Upon renewal, I paid the CA, and they reissued me with a new public key (AKA certificate), which has a new date into the future.

Given that I did not supply the CA with a new CSR, can I assume that

a) the CA used the previous CSR, and

b) my private key is still valid / has not changed.

Is my understanding so far correct?

c) To verify that the new public key, matches with the old (unchanged) private key, I can run the openssl tool and compute the modulus for the private key and public key. , and they should match, correct ?

d) Therefore, that also means that the modulus for the newly issued certificate should match with the modulus of the old certificate, correct ?

Answer 1

Yes. This article recommends doing exactly what you suggest; extract the modulus from both public and private key and check that they match.

But moreover, if they have re-issued based on the same CSR, then the entire public key in the certificate should be the same as the old certificate (this includes the modulus n, but also the public exponent e). So you should be able to look at the public keys in the old and new certificates and see that they are identical.

Answer 2

What you describe is generic and, in your specific case, more complex than it should be.

Export public key from the old and from the new certificates e.g. in the PEM format and compare the files. They must be identical.

Using PEM format allows to use text comparison. Thus, you have more diff tools to choose from.