Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up a small X.509 certificate authority for internal use in my network. Now I want to renew a certificate, and I want to know how should I do it.

  • Can the new certificate reuse the same key pair as the expired one?
    • Should it?
  • Can I reuse the serial number too?
share|improve this question
up vote 0 down vote accepted

Typically best practice is to place the old cert on a CRL and generate a new one from scratch. I wouldn't re-use anything, just bad practice imho. In some instances you might be able to get away with reusing different bits, but I for one consider that a problem with the certificate trust model.

If you are talking about the root certificate, I make them last for a REALLY long time when setting up private CAs.

share|improve this answer
Note that CRL = Certificate Revocation List. – harrymc Dec 3 '10 at 12:04
There is not a "one practice fits all" solution. Think about a complicated networking system, with plenty of client/server intercommunication that relies on the same certificate root. If you totally replace that root with a new one you are about to introduce a lot of massive work, downtimes and potential issues into your system. If there is no reason to think your CA has been compromised because you did adhere to best security practice - that includes keeping your CA offline and its key in a safe - you just want to extend its validity time by renewing. Really. – Dakatine Sep 12 '13 at 8:13
Because no matter how long is that root validity, it is going to expire a day. :) – Dakatine Sep 12 '13 at 8:20

Renewing the same private key when it's getting close to expiration is the exact same as renewing password that's getting close to expiration. If the password/key isn't compromised, then you're not doing anything wrong.

But "best practice" would tell us that one doesn't always know if a password/key has been quietly compromised, and thus it is best to follow expiration and replacement policies.

share|improve this answer

Do not duplicate neither the key pair nor the serial number.

If a certificate is revoked, then it is identified in the Certificate Revocation List (CRL) by its serial number. If you would like to be able to revoke the old one while keeping the new one, don't reuse the serial number.

share|improve this answer

A certificate request is 'SIGNED' by the private key, if a certificate has been revoked or has expired, the same private key can most certainly be reused to sign a new CSR. Since the private key never becomes part of the CSR or the CRT, it is never exposed in transit in any form as that would defeat the purpose of calling it a 'private' key.

Read up on RSA Public/Private key encryption and signing if you want to understand how this works.

share|improve this answer
I think this does not answer the question at all. – Dakatine Sep 12 '13 at 9:12
Also it shows your lack of understanding of Certs and Keys @Geoffrey – linuxdev2013 Apr 29 '15 at 22:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.