0

we've a server apache and the certificate is expired. We have an SSL Wildcard certificate issued by Sectigo. I generated the new certificate on our reseller site and we're going to upload it in the machine with apache. We didn't use the private key to generate the new certificate because it wasn't an option on my reseller's site. Do we just need to overwrite the old certificates with the new one? Or do I need to change the private key?

Thank you.

Improve this question

1 Answer 1

Reset to default
1

CA sites don't request the private key, simply because if they did, the key wouldn't be "private" any more. When requesting a certificate, usually you upload a certificate request, which requires a private key to be made.

Some issuers offer the possibility to "renew" the certificate, in which case, you don't need a request, because they reuse the fields from your existing certificate.

If you generated the new certificate with a request, then you will need the private key used to make that request. If you didn't need a request, then the certificate probably got issued according to your existing one, so you need to reuse your private key for it.

You can make sure that the key you already have and the certificate matches with the following commands:

openssl x509 -in /the/certificate.pem -noout -modulus

and (assuming you have an RSA key)

openssl rsa -in /the/private/key -noout -modulus

If the two commands give the same output, then the key and the certificate matches.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .