I want to renew my expired certificate I'm using in Tomcat for SSL. Other posts indicate that to renew my certificate I need to create a new CSR and obtain a new certificate and import into my keystore. However, if my private key is the same, why can I not just use the original CSR to request a new certificate?
asked Jul 27, 2016 at 20:26
-
2Closely Related to: serverfault.com/questions/286102/can-i-reuse-a-ssl-csr– HashHazardJul 27, 2016 at 20:51
Add a comment
|
4 Answers
The short answer is that while yes you can reuse the CSR, it doesn't mean you should.
It's worth considering that encryption methods can improve over time (e.g., generating RSA keys @ 2048 or 4096 vs 1024 awhile back, sha256 vs. sha512, etc) so it's probably best to just generate a new one considering how trivial it is and increasing the private key strength if it's outdated.
answered Jul 27, 2016 at 20:58
Technically no, if you're keeping the same private key. Most CAs use the CSR purely as a mechanism to provide the public key for the certificate. Especially for Domain Validated (DV) certificates, everything else in the CSR is thrown away. The public key value is hopefully verified against the signature on the CSR before being copied into a certificate structure for signing by the CA.
You will need to create a new CSR, as your current certificate has expired.
-
3Incorrect. The expiry date is created in the signed certificate; it's not included in the CSR at all.– ShadurJul 28, 2016 at 6:51
Yes, you will need a new CSR for the domain and your user name/password. Some web servers allow to use old CSR but I recommend to create a new CSR.
