Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

SendMail 8.13.8 | CentOS 5.x

Hi Guys,

I'm using ca-signed TLS certificates on my sendmail server and they are up for renewal soon. Our new CA doesn't like our old CSR so I need to generate a new CSR.

Can someone point me to the procedure for doing this (without affecting the production certs that are already in use)? I'm paranoid of overwriting the old TLS certs in the process of generating a CSR.

Most of the instructions I've found are for implementing self-signed TLS certs -- which isn't an option for me at this time.

I'm thinking it would something like:

openssl req -new -nodes -out new-tls.csr -keyout new-tls-private.key 

But I wasn't sure if I was missing some options there such as the -x509 option...


share|improve this question

I'm far from an expert with SSL certificates or sendmail, but ... ;)

Maybe your CA has instructions for OpenSSL which might help? Verisign has Apache centered instructions here:

and with Apache, it was merely a case of doing something simple like that - two steps, a key and a certificate request - and instead of step 5, getting it signed, then changing the Apache ssl config to point to the new files and restarting it.

If you're asking for what options you could, or might want to, put in - I have no clue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.