2

My organization has several certificates used for web services that are going to expire soon. We want to have these certificates renewed so that the service to our clients is uninterrupted and doesn't require any action on their part. Is this possible, and if so, what would need to be done (e.g. create a CSR from the existing certificate, etc.)? Thank you in advance

1
  • Are these self-signed certificates? If they aren't then you should be able to just create new certificates with the CA and they'll be trusted by the clients.
    – user
    Dec 19, 2019 at 18:52

1 Answer 1

3

The expiration of a certificate is included in the certificate itself and not external to the certificate. Changing the expiration thus would require changes to the certificate itself. But a certificate cannot be changed since this would invalidate the signature on the certificate. Because of this there is no way to extend the validity time without creating a new certificate.

... service to our clients is uninterrupted and doesn't require any action on their part

With a typical PKI based validation of certificates no changes or action in the clients are needed to handle the new certificates. Even if clients use pinning this is not a problem as long as the client pins to the public key and not the certificate itself and the new certificate uses the same key as the old one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.