Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I create a new key pair for my SSL certificate without getting the cert reissued?

share|improve this question
No. (Or, if you want a different answer, yes, but it will definitely never work.) That's the whole point of issuing a certificate. :) – pino42 Nov 7 '12 at 15:04

Nope. You can't do that.

If you've lost the key, you'll have to get it reissued. Most certificate providers are OK about this, though. Some even offer insurance for it.

I've had a certificate regenerated about 4 hours after I had it issued, because i got the CN wrong.

share|improve this answer


The certificate contains the digital signature of the certificate authority. This signature certifies that the SSL certificate was not changed. The certificate contains the public key too and this is generated from the same prime number as the private key (for RSA certificates). So it is not possible to change the private key without changing the public key and in turn without changing the certificate. Changing the certificate will render it invalid because the signature will not match the rest of the data.

Here is the procedure for creating a new certificate if the old one is compromised:

  1. Create a new SSL key pair
  2. Create a certificate request
  3. Send the certificate request to the CA to be signed. This could cost, depending on the CA. The price could range from 0 to the price of a new certificate.
  4. Install the new certificate
  5. Ask for the old certificate to be revoked.

If security is the top priority do step 5 first.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.