Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their requirement is that our ssl certificate has 'Data Encipherment' in the 'Key usage' field. Currently our ssl for the site doesn't. Trying to see if it is as simple as somehow editing existing certificate without having to buy a new one.
2 Answers
Certificates are signed. The signature covers all the certificate contents, including the Key Usage extension. You cannot change anything in the certificate contents, not the smallest bit, without invalidating the signature. So no, you cannot "change" a certificate. Certificates are immutable by construction.
Your certificate vendor might accept to give you, or sell you with a discount, a new certificate which fits your requirements.
answered May 17, 2013 at 22:18
-
@ThomasPomin - Thank you. Can you please point me to what exactly is 'Data Encipherment' and how it is used? Currently the site doesn't have this in its certificate, I need to host a web service for which "Data Encipherment" is a requirement in its certificate. I am trying to somehow use the existing site cerficate but your answer says I can't. so if I get a new certificate with Data Encipherment added and use that for the whole site, does that affect anything performance wise? I guess question is what is the overhead of having Data Encipherment enabled in the key usage.– BrianCommented May 17, 2013 at 23:20
-
Data Encipherment means that the key pair is approved (by the CA vendor) to provide encryption. Whether you permit your server to provide encryption (such as HTTPS) is a matter of how you've configured your server. Performance will be dictated by your system and you've configured it. I won't say it has nothing to do with the key pair or the cert - different key pairs, different settings in the certificate can change performance a bit - but not the data encipherment setting. Commented May 20, 2013 at 15:03
-
Does this happen to be a health care web service involving a provider of admissions processing? I found your post when researching this same issue, because of a request from a vendor. Wondering if it's the same one. Commented Mar 20, 2014 at 22:00
It might depend a bit on the certificate vendor's policy, but usually changes in the certificate require you to buy a new one.
answered May 17, 2013 at 21:37
