3

What is the difference from CA perspective between renewal and rekeying of the certificate previously issued by this CA?

6

From RFC 3647: Internet X.509 Public Key Infrastructure -- Certificate Policy and Certification Practices Framework:

4.4.6. Certificate Renewal

This subcomponent is used to describe the following elements related to certificate renewal. Certificate renewal means the issuance of a new certificate to the subscriber without changing the subscriber or other participant's public key or any other information in the certificate:

  • Circumstances under which certificate renewal takes place, such as where the certificate life has expired, but the policy permits the same key pair to be reused;

Which contradicts itself in that it initially states that during renewal you cannot change the public key or any other information in the certificate, but then goes on to say that a renewal can take place where the certificate life has expired.

and...

4.4.7. Certificate Re-key

This subcomponent is used to describe the following elements related to a subscriber or other participant generating a new key pair and applying for the issuance of a new certificate that certifies the new public key:

  • Circumstances under which certificate re-key can or must take place, such as after a certificate is revoked for reasons of key compromise or after a certificate has expired and the usage period of the key pair has also expired;
3

Here's a quote from Symantec's Certificate Policy statement:

Generally speaking, both “Rekey” and “Renewal” are commonly described as “Certificate Renewal”, focusing on the fact that the old Certificate is being replaced with a new Certificate and not emphasizing whether or not a new key pair is generated.

Then they define Rekey and Renew as (emphasis mine)

Certificate renewal is the issuance of a new certificate to the subscriber without changing the public key or any other information in the certificate. Certificate renewal is supported for Class 3 certificates where the key pair is generated on a web server as most web server key generation tools permit the creation of a new Certificate Request for an existing key pair.

Certificate rekey is the application for the issuance of a new certificate that certifies the new public key. Certificate rekey is supported for all certificate Classes.

Really just comes down to policy. A CA could decide that it will always prohibit issuance of a certificate using a key already certified. Having (and enforcing) that policy requires a more expensive issuance process than merely verifying that the subject identification material is valid, since they would need to compare the public key to all previously issued certificates.

The CA/Browser Forum's Baseline Requirements has no stipulations for renewal or re-key (sections 4.6 and 4.7), and the Extended Validation requirements don't seem to mention the keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.