When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields later? (E.g. my company changed its legal name and now I want to update the "Organization" name to reflect the new one.)
Add a comment
|
4 Answers
No, if you changed those informations on the certificate, the fingerprint changed, and the signature is invalid.
You will need to issue a new certificate.
answered Mar 18, 2021 at 15:16
-
1
-
13
I like to compare certificates to driver's licenses. Can you take a sharpie and change the First Name, Last Name, Address on your driver's license? No, you need to contact the government and get a new license printed.
Slightly less sassily, a certificate is basically a signed statement from a trusted 3rd party (the CA) that says "This public key belongs to this person". All the fields you mention (First Name, Last Name, Organization Unit, Organization, City, State,...) are part of "this person". If you were able to freely modify these fields without the consent or knowledge of the CA, then that would completely defeat the purpose of a certificate.
answered Mar 18, 2021 at 15:44
-
10Not the best analogy. In Germany they actually just put small stickers over the address of your ID card or the issue date on your drivers licence, instead of printing new ones. They use a ballpoint pen to write the issue date though, not a sharpie.– kapexMar 19, 2021 at 9:57
-
-
2Yes really. The stickers have some security features like the same fine printed background patterns as the IDs and probably use some special material. You probably can get them of without destroying them. But they aren't as durable as the cards - the issue date on my driver's licence has worn of completely by now.– kapexMar 19, 2021 at 13:19
-
Sorry I meant to write "You probably can't get them of without destroying them."– kapexMar 19, 2021 at 13:44
-
1+1 Excellent answer, as usual. To put it another way - if it was possible to change the identifying information on a certificate this easily, without breaking the signature - then what would stop an attacker from getting a CA-signed certificate in his name, then changing the name to paypal.com, then using it to MITM Paypal?– mti2935Mar 20, 2021 at 17:23
No, changing any field in the certificate will break the signature. You need to get a new certificate with the updated info. This is exactly like asking the question "I have a certificate for rsc.com, can I just change it to say it's for google.com?".
In the spec, all the fields of a certificate are in a structure called "to be signed certificate", with the signature added.
-
2It is not exactly the same as asking that question because it could be that some fields could be changed while others don't.– rscMar 18, 2021 at 15:28
-
2
While the other answers correctly point out that strictly speaking, there is no way to modify a certificate, that's not the end of the story.
A certificate comprises three components:
- Public key
- Name (Subject, possibly SubjectAltNames as well)
- Signature binding the former two together
While there is no way to change the name without replacing the signature as well, that doesn't mean you can't reuse the key pair. You can just take the old key pair and reissue a certificate with a new name. This might simplify handling of the reissued certificate. (This is also one way to handle renewals of expiring certificates.)
Depending on the application, you can take it a bit further and reuse most of the information from the old certificate, for example the validity dates and the serial. However, this still might not make make the two certificates completely interchangeable, because the Issuer name will change anyway when self-signing.
-
There's another complication though: how the client (or whatever) is configured to trust that self-signed certificate. Even if you issue a new cert with the same public key, it generally won't be automatically trusted under the same policy as the old one (because its fingerprint changed, or something similar). Mar 20, 2021 at 21:53
-
1@GordonDavisson Right, that's why I wrote it might simplify things. It's probably not too useful for CA and server certs (or authentication in general) due to the trust anchor issues you mentioned. It does help for client certs, S/MIME and the like, where it's good that the "new" keypair can still decrypt everything encrypted to the old one.– TooTeaMar 21, 2021 at 12:34