My website on a shared server has a SSL certificate installed and I want to move the certificate to a dedicated server that's supplied by a different hosting company. The current hosting company says that they need a new CSR. Why can't I just re-install the existing one on the new machine without creating a new CSR?
If you're on a shared host, it's likely that the certificate that's in use is also used for a number of other sites. You should be able to check the list of Subject Alternative Names (SAN) in that old certificate.
In such a situation, the certificate isn't really yours, but you've authorised your hosting company to be issued with a certificate that covers your domain name. If they gave you the corresponding private key, they'd effectively give you the ability to host all the other shared host names on that server, which is certainly not acceptable for the other customers.
Even if that certificate isn't shared with other customers, the hosting company will have access to its private key, and it could technically keep serving your domain name. It's good practice to re-key your certificate when moving from one hosting company to another, at least to take control over your old certificate away from the old company.
When moving to a new host, you would want:
- to make sure that the old certificate is revoked, so that the hosting company can no longer server your host name with that certificate;
- get a new certificate for your new dedicated host.
To prevent the old certificate from being used any further, it makes sense to generate a new key-pair, in addition to revoking the old certificate (since whoever controls that old certificate would also have its private key). Hence, you need to create a new CSR.
It's probably because they have a system that does not allow to recover the original private key. If they use a kind of HSM (Hardware Security Module) then they entered the private key into the system once they generated it and then shred the key or even the HSM has a functionality to generate a request not exporting the private key.