Currently I have a cert (signed with SHA1) expiring soon and I have extended its expiry incorporating SHA2 signing algorithm. I have done this by creating another CSR using certutil command with the undocumented -Z SHA256 option. However now, some of my applications encounter problems and I have to revert back to SHA1. Can I know whether i just need to reissue the cert and choose SHA1 as the signing algorithm or do I need to create a whole new cert based on a new CSR with SHA1? thanks

1 Answer 1


If you are asking can you use the same keypair, yes you can always use the same keypair. Your first and second certs could have also used the same keypair.

If you mean will the CSR do a reissue instead of requiring you to purchase a new cert? That isn't a technical question. They certainly "can" but most will not. Any change to the cert will require you purchasing a new cert.

You have a bigger problem however. I don't think any CSR are still issuing certs using SHA-1 anymore. While it may not matter for your purposes most browsers have deprecated SHA-1 certs so for compatibility reasons they will probably require for it to use SHA-256.

  • Hi, the CA web site allows me to choose the signing algorithm, either SHA1 or SHA2. It also allows me to load previous CSR. Hence in this case, I can just choose SHA1 and click reissue? Commented Jul 8, 2015 at 2:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .