Often one hears about "renewing an SSL certificate" or "renewing an X.509 certificate", but I wonder what this actually means. Usually, step #1 of the renewal process is "generate a new CSR". Doesn't this mean that what is actually happening is that a new certificate is actually being issued, possibly with the same information (and maybe even the same public/private key pair) as the expired certificate?
Is anything guaranteed to stay the same when the certificate is renewed? The subject would have to stay the same (otherwise, how could it be considered the same certificate?), but what else?