1

i have an existing cert with 15 SubjectAlternativeName entries.

How can I use keytool to add several more SubjectAlternativeName entries to the keystore's certificate without invalidating it.

I'm wondering if there is a way to upgrade the keystore without a new request/csr.

Improve this question

2 Answers 2

Reset to default
10

You can't modify an already-issued certificate; EVER. That's the whole point of having it digitally signed by a Certification Authority in the first place.

You need to generate (or request) a new one if you need to change anything, including of course the SANs it includes.

Improve this answer
1
  • 1
    I regret only that I have but one upboat to give to this answer.
    – Magellan
    Feb 2, 2016 at 23:43
0

You will need to submit a new request to your issuer.

The certificate you already have will have to be replaced with the newly issued certificate. The SANs (and other certificate properties) are part of the specific certificate/key pair that was issued to you. (Some vendors call this process a reissue, as opposed to issuing a new certificate)

If you could add SANs to an existing certificate yourself, there is nothing to stop you from putting whatever you want... You could have a cert for mydomain.com and add a SAN of www.google.com. Any of these types of changes must be performed by a Certificate Authority, and a new certificate issued with those changes. This is the whole chain of trust that makes the certificate issuing process work.

Improve this answer
1
  • 3
    As a passing note, the "key pair" is not issued to you by any reputable CA. You generate the keypair, and from that a CSR, which you submit to a CA for certification.
    – MadHatter
    Feb 2, 2016 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .