Renewing a CA cert

Devilsbane

Quick queston. If you renew the CA certificate you can choose to keep the same key pair or generate new keys. Generating new keys is obviously more secure, but is this then going to expire all of the certs that were created with the old pair? I can't find a definitive answer, but it seems logicial.

Thanks

undomiel

It's not quite my area of expertise but you may want to read this article: Root CA certificate renewal - ?????????? ?????? and this one: Renewing a certification authority: Public Key

Forsaken_GA

Devilsbane wrote: »

Quick queston. If you renew the CA certificate you can choose to keep the same key pair or generate new keys. Generating new keys is obviously more secure, but is this then going to expire all of the certs that were created with the old pair? I can't find a definitive answer, but it seems logicial.

Thanks

Generally speaking, for x509 cert implementations, you can renew your CA cert off the same key pair. The only thing that expires is the public certificate, not the private keys. You'll need to distribute and install the new public CA cert through whatever means you initially distributed it. The same thing goes for client certs as well. There's no need to generate a new keypair, you just generate a new CSR off your exisiting key pair, send the CSR in for the CA to sign, and install the new cert that you get back.