One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a certificate? leads me to think that the chaining is maintained with the new certificate (same CA). However, when testing the website I now get "Warning...Untrusted...(expired cert)". Was the certificate supossed to come with new keys or can I generate them using the re-newed certificate?

I am using Java Keystore and Portecle to maintain my keystore, certs, and keys. The certificate is a SSL wildcard cert. I also restarted Apache.

I have also found the following...it seems to indicate that chaining is maintained also... How to go about an ssl certificate renewal.

Any advice is appreciated...


1 Answer 1


A certificate is your public key and some information about the site and then a lifetime. All this is signed by the issuer CA. The certificate is public and thus also the public key, but the private key is not published.

One of our SSL certificates has expired and along with that so has the keys.

While the certificate will expire the public and private key have no expiration time. Thus you could in theory re-use the same key for the renewed certificate and this is often also done this way (unless the key is compromised or got too weak with the years).

Was the certificate supossed to come with new keys ...

A certificate does not come with keys. You usually create the keys locally and then send only the public key to the certificate issuer but keep the private key secret. Although some issuers let you create the key online, in which case you get the key pair additionally to the certificate. If this was the case only you know.

I now get "Warning...Untrusted...(expired cert)"

In this case the site probably still provides the old expired certificate, that is you made some error when re-configuring the site for the new certificate.

  • If I am to understand correctly it might be the way I imported the new cert into the keystore? I am currently in the process of rebuilding the keystore with portecle using the original keys and the renewed certificate.
    – scopedial
    Commented Aug 30, 2015 at 18:43
  • 1
    @scopedial: since I have no idea what you really did it is hard to know what went wrong. But since you are using apache - as far as I can see the tool you use will not adapt the apache configuration for you (i.e. place the new certificates at the right place) so that the new certificate will be active. Apache will not use the Java keystore. Commented Aug 30, 2015 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .