When creating a self-signed certificate you are asked to enter some information (First Name, Last Name, Organization Unit, Organization, City, State,...). Is it possible to update any of those fields later? (E.g. my company changed its legal name and now I want to update the "Organization" name to reflect the new one.)
I like to compare certificates to driver's licenses. Can you take a sharpie and change the First Name, Last Name, Address on your driver's license? No, you need to contact the government and get a new license printed.
Slightly less sassily, a certificate is basically a signed statement from a trusted 3rd party (the CA) that says "This public key belongs to this person". All the fields you mention (First Name, Last Name, Organization Unit, Organization, City, State,...) are part of "this person". If you were able to freely modify these fields without the consent or knowledge of the CA, then that would completely defeat the purpose of a certificate.
No, changing any field in the certificate will break the signature. You need to get a new certificate with the updated info. This is exactly like asking the question "I have a certificate for rsc.com, can I just change it to say it's for google.com?".
In the spec, all the fields of a certificate are in a structure called "to be signed certificate", with the signature added.
While the other answers correctly point out that strictly speaking, there is no way to modify a certificate, that's not the end of the story.
A certificate comprises three components:
- Public key
- Name (Subject, possibly SubjectAltNames as well)
- Signature binding the former two together
While there is no way to change the name without replacing the signature as well, that doesn't mean you can't reuse the key pair. You can just take the old key pair and reissue a certificate with a new name. This might simplify handling of the reissued certificate. (This is also one way to handle renewals of expiring certificates.)
Depending on the application, you can take it a bit further and reuse most of the information from the old certificate, for example the validity dates and the serial. However, this still might not make make the two certificates completely interchangeable, because the Issuer name will change anyway when self-signing.