My organization has several certificates used for web services that are going to expire soon. We want to have these certificates renewed so that the service to our clients is uninterrupted and doesn't require any action on their part. Is this possible, and if so, what would need to be done (e.g. create a CSR from the existing certificate, etc.)? Thank you in advance
1
-
Are these self-signed certificates? If they aren't then you should be able to just create new certificates with the CA and they'll be trusted by the clients.– userDec 19, 2019 at 18:52
Add a comment
|
1 Answer
The expiration of a certificate is included in the certificate itself and not external to the certificate. Changing the expiration thus would require changes to the certificate itself. But a certificate cannot be changed since this would invalidate the signature on the certificate. Because of this there is no way to extend the validity time without creating a new certificate.
... service to our clients is uninterrupted and doesn't require any action on their part
With a typical PKI based validation of certificates no changes or action in the clients are needed to handle the new certificates. Even if clients use pinning this is not a problem as long as the client pins to the public key and not the certificate itself and the new certificate uses the same key as the old one.
answered Dec 19, 2019 at 18:50
