Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've generated a self certified SSL cert for testing a new web site. The time has come for the site to go live and I now want to purchase a cert from GeoTrust. Can I use the same CSR that I generated for the self cert, or do I need to create a new one?

Rich

share|improve this question
up vote 9 down vote accepted

As long as your using the same key, domain (aka common-name), contact details and validity period you should be able to use the same CSR.

Though to be honest generating a CSR is a pretty simple job, so if you need to amend the contact details (which a lot of SSL providers are strict on) it's not a big deal.

share|improve this answer
1  
I agree. Generating a CSR is such a trivial task I don't see why you'd even bother trying to reuse one. – joeqwerty Jul 1 '11 at 12:18
2  
Once you have OpenSSL installed, you can generate a new CSR in about 30 seconds. And if you think it will take you much longer- then definitely do it because you need the practice!!!!! – Austin ''Danger'' Powers Mar 31 '13 at 2:17

For your example case, I don't think it's worth trying to reuse CSRs. However, for a large diverse team Apple iOS developers (like I have) there is a good reason to do this. We create (actually, ask Apple to create) all our signing certs and push certs off the same private key. That way we can all collaborate easily on our 85+ apps. For this reason, we keep a single CSR lying around and always use the same one for as long as the key is valid.

As far as I know, there is no reason to repeatedly generate CSRs from a single private key. I'd love to be corrected if I am wrong.

share|improve this answer

The main benefit of having limited-duration certificates is to reduce the damage if your private key is leaked. Somebody possessing the private key can otherwise impersonate being you forever if you reuse the CSR, because re-using the CSR implies reuse of your private key as well.

Please don't do that, it's better to automate generation of both the private keys as well as the CSRs and find convenient ways to distribute the ever-changing private keys to application build servers and push servers. Most mere mortal developers would normally never need to do a release/distribution-build for the app store anyhow, so won't need the private keys.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.