New certificate but what about the keys?

Question

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a certificate? leads me to think that the chaining is maintained with the new certificate (same CA). However, when testing the website I now get "Warning...Untrusted...(expired cert)". Was the certificate supossed to come with new keys or can I generate them using the re-newed certificate?

I am using Java Keystore and Portecle to maintain my keystore, certs, and keys. The certificate is a SSL wildcard cert. I also restarted Apache.

I have also found the following...it seems to indicate that chaining is maintained also... How to go about an ssl certificate renewal.

Any advice is appreciated...

Answer 1

A certificate is your public key and some information about the site and then a lifetime. All this is signed by the issuer CA. The certificate is public and thus also the public key, but the private key is not published.

One of our SSL certificates has expired and along with that so has the keys.

While the certificate will expire the public and private key have no expiration time. Thus you could in theory re-use the same key for the renewed certificate and this is often also done this way (unless the key is compromised or got too weak with the years).

Was the certificate supossed to come with new keys ...

A certificate does not come with keys. You usually create the keys locally and then send only the public key to the certificate issuer but keep the private key secret. Although some issuers let you create the key online, in which case you get the key pair additionally to the certificate. If this was the case only you know.

I now get "Warning...Untrusted...(expired cert)"

In this case the site probably still provides the old expired certificate, that is you made some error when re-configuring the site for the new certificate.