Renewing a CA cert

DevilsbaneDevilsbane Member Posts: 4,214 ■■■■■■■■□□
in MCSA/MCSE: Security
Quick queston. If you renew the CA certificate you can choose to keep the same key pair or generate new keys. Generating new keys is obviously more secure, but is this then going to expire all of the certs that were created with the old pair? I can't find a definitive answer, but it seems logicial.

Thanks
Decide what to be and go be it.
· Share on FacebookShare on Twitter

Comments

  • undomielundomiel Member Posts: 2,818
    It's not quite my area of expertise but you may want to read this article: Root CA certificate renewal - ?????????? ?????? and this one: Renewing a certification authority: Public Key
    Jumping on the IT blogging band wagon -- http://www.jefferyland.com/
    · Share on FacebookShare on Twitter
  • Forsaken_GAForsaken_GA Member Posts: 4,024
    Devilsbane wrote: »
    Quick queston. If you renew the CA certificate you can choose to keep the same key pair or generate new keys. Generating new keys is obviously more secure, but is this then going to expire all of the certs that were created with the old pair? I can't find a definitive answer, but it seems logicial.

    Thanks

    Generally speaking, for x509 cert implementations, you can renew your CA cert off the same key pair. The only thing that expires is the public certificate, not the private keys. You'll need to distribute and install the new public CA cert through whatever means you initially distributed it. The same thing goes for client certs as well. There's no need to generate a new keypair, you just generate a new CSR off your exisiting key pair, send the CSR in for the CA to sign, and install the new cert that you get back.
    · Share on FacebookShare on Twitter
Sign In or Register to comment.