Can we generate the CSR (certificate signing request) used for certificate signing from the signed certificate? It should work with the original private key when signed again with different authority.
What the user literally asked and actually wanted are slightly different things. Here is how to get what the user asked for. Hat tip
openssl x509 -x509toreq -in $SITENAME.crt -signkey $SITENAME.key -out $SITENAME-new.csr
This uses the all the certificate meta-information and the existing key from the existing certificate to create a new CSR. The new CSR must be sent to the new provider.
Note: it is seen as somewhat of a risk to re-use the same key over very long periods of time. However, given that certificates must be renewed every year or two years, while a 2048-bit key should be secure through 2030. This assumes your site has not been compromised in anyway and that the key was not leaked due to the various vulnerabilities found in SSL in the last ten years.
For SNI: With hat-tip to "shams.haq" (unverified), with openSSL 3+:
openssl x509 -x509toreq -copy_extensions copyall -in $SITENAME.crt -signkey $SITENAME.key -out $SITENAME-new.csr
Using OpenSSL, this is what you would do:
$ openssl req -out codesigning.csr -key private.key -new
Where private.key is the existing private key.
As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.
As per your comment, if you do not have access to the existing private key then you can create a new private key and CSR:
$ openssl req -out codesigning.csr -new -newkey rsa:2048 -nodes -keyout private.key
The end results remain the same, you get a CSR and issue a new certificate.
Yes, as long as you have the private key, you can re-issue a new CSR by copying the fields (Country Name, State or Province Name, Locality Name, Organization Name, Organizational Unit Name, Common Name, Email Address) from the existing certificate to the CSR.
Edited from my comment: If you don't own the private key anymore you cannot generate a CSR. The private key is required in order to verify the identity of the requester (you) via digital signature; otherwise it would be trivial to generate CSRs - and then certificates - with fake credentials, and spoof any existing entity.