Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to create a new certificate for an internal server. It is self signed. Is there an easy way to just extend the expiration date of the current certificate? If not, can I reuse the current key, or do I need to generate a new one? I'll be using Java keytool.

All info I can find online it looks like I need to create a new keystore, but I'd rather skip that step if possible just to keep things simple.

share|improve this question
Did you change the hostname or FQDN? – mdpc Dec 14 '12 at 22:54
up vote 2 down vote accepted

No, there is no way to extend the expiration date of a certificate.

Yes, you can create a new certificate with a different expiration date that reuses the same public/private keypair.

If you want the private key and certificate combined in a single unit, you'll have to combine the private key with the new certificate.

share|improve this answer

It doesn't really matter what the key is, as long as it's signed by your certificate authority. Also, it's the CA that decides what the expiration date of the certificate is. Basically, run the self-signing procedure again, using either the same or a different certificate signing request. When acting as the CA, pick whatever expiration date you want.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.