I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site is signed by a CA (usually an intermediate CA who is itself signed by a root CA) and this public key/certificate tends to expire every 3-4 months.

What happens after it expires? Can you extend the validation period of the same public key or do you need to get a new one? I know some hosting providers such as Bluehost who say they extend the validation period automatically using the same public key, is this what usually happens?

If the intermediate CA gets compromised, would you be able to have the same public key simply signed by another intermediate CA and keep your site active?

For context, I'm looking to implement SSL pinning using the public key for my site and am wondering what the worse case scenarios could be if a CA in my site's chain gets compromised, or if at the end of my site's certificate, the public key is changed.

  • 1
    In short: the key might change or it might stay the same, depending on the process used by the one who requested the new certificate. If you are in control yourself you can make sure that the key stays the same, but if it is about a third-party certificate you cannot rely on this. As for CA getting compromised - this should be asked as a separate question, i.e. don' pack multiple topics into one question. Mar 15, 2023 at 6:05
  • With regard to your last paragraph - this is one of the main reasons why HPKP never gained much traction. If you need to change your public key for any reason (including the reasons that you mentioned, as well as others), then this will prevent your users who have pinned your public key from being able to access your site. See blog.qualys.com/product-tech/2016/09/06/… for more info.
    – mti2935
    Mar 15, 2023 at 12:12