I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?

1 Answer 1


No, the only way to change the validity date is to re-issue.

The reason is that the certificate's hash is calculated after the rest of the certificate is written, editing that field would cause the certificate's hash to change. If the hash is changed anyone else checking the certificate will know it has been altered, but won't be able to tell what changed. While this won't automatically prevent a connection, it will throw errors and warnings.

  • If so, how to configure expiration date in openssl command ?
    – Hakim
    Commented Jun 12, 2015 at 16:07
  • 2
    The command line options are using -days, or -enddate. I've always set it using the configuration file, openssl.cnf, where you can search for default_days and edit its value.
    – ztk
    Commented Jun 12, 2015 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .