I have a VeriSign certificate on one of my Linux / Apache websites that is going to expire. I plan on buying a renewal from VeriSign.

What is the best way to renew the certificate with Apache? Do I have to generate a new request and start over? Are there any pitfalls I should watch out for?


You can just have the current certificate's request resigned. However that does (in theory) lower security.

In practice as long as your key was properly generated and never used on a Debian or Ubuntu machine that had the SSL entropy issue and there's no problems with formally trusted people still having a copy of the key you're fine.

I generally just re-sign, although as I said above, if you're at all concerned, just generate a new cert. It's the same process.


If you chose to renew the Certificate using the copy saved on VeriSign:

  1. Go to the VeriSign website and chose to use the stored CSR. This will be checkbox when you chose to renew the certificate on their site.
  2. Once they have finished processing the request, the new certificate will be emailed to you.
  3. Save the certificate the was in an email to a new a file on the server, and configure the ssl.conf or httpd.conf SSLCertificateFile directive to point to the new file.
  4. Possibly required (Was for me): Go to this VeriSign link, download VeriSign's new intermediate certificate and save it to a file. Then change the SSLCACertificateFile directive to point to that new file as well.
  5. Restart Apache

you do not have to regenerate the request (certificate signing request, or csr), as the validity time applied by the signing authority. If you wish, you can submit the original csr for signing this time too, but be noted, the resulting certificate is different, as the signing part has been changed. The advantage of re-using csr is that you don't have to mess with the key part of a certificate.

  • So since the validity time is applied by the signing authority, will I have to install a new certificate if I used the copy of the csr that was saved on VeriSign? – Kyle Brandt Jul 20 '09 at 15:03
  • Kyle: Yes you will :-) – Kyle Brandt Jul 20 '09 at 15:22

If you have the existing signing request, you can submit that again without any issues. Many registrars will actually keep a copy of your last csr for the purposes of renewals anyway. If that's not an option, a new csr is easly generated with:

openssl req -new -key <server>.key -out <server>.csr

Make sure you enter the Common Name (CN) as the address that'll be used in the URL to prevent clients throwing warnings.

One thing I am fond of doing on my own servers is to keep the old certificates around and organise my /etc/ssl/certs folder into years based on the date issued (or alternatively expiring). Helps me keep track of how many times the certificate has been renewed and when it's likely to be due for renewal next.

For reference, if you'd like a new key too, you'll want to do the following. In this case you will need to generate a new csr from this key.

openssl genrsa 1024 -out <server>.key
chown root <server.key>; chmod go-rwx <server.key>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.