Here is the scenario, just wanted confirmation that I am understanding it correctly.

I have a TLS certificate that will expire soon;

Upon renewal, I paid the CA, and they reissued me with a new public key (AKA certificate), which has a new date into the future.

Given that I did not supply the CA with a new CSR, can I assume that

a) the CA used the previous CSR, and

b) my private key is still valid / has not changed.

Is my understanding so far correct?

c) To verify that the new public key, matches with the old (unchanged) private key, I can run the openssl tool and compute the modulus for the private key and public key. , and they should match, correct ?

d) Therefore, that also means that the modulus for the newly issued certificate should match with the modulus of the old certificate, correct ?

2 Answers 2


Yes. This article recommends doing exactly what you suggest; extract the modulus from both public and private key and check that they match.

But moreover, if they have re-issued based on the same CSR, then the entire public key in the certificate should be the same as the old certificate (this includes the modulus n, but also the public exponent e). So you should be able to look at the public keys in the old and new certificates and see that they are identical.

  • 1
    How weird, the modulus of the certs did not match for me - the CA is Digicert; hence I had to start from scratch with new private keys.
    – joedotnot
    May 18, 2022 at 8:17

What you describe is generic and, in your specific case, more complex than it should be.

Export public key from the old and from the new certificates e.g. in the PEM format and compare the files. They must be identical.

Using PEM format allows to use text comparison. Thus, you have more diff tools to choose from.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .