Does renewing SSL certificate require re-issuing the cert? Does renewing SSL certificate require re-issuing the cert? nginx nginx

Does renewing SSL certificate require re-issuing the cert?


It's not possible to extend the expiration of an existing certificate once issued. The only way is to issue a new certificate.

Most certificate authorities offers a "renewal" concept, which provides some advantages compared to a new purchase. For example, you can renew in advance to the certificate expiration, and they will issue the new certificate from the expiration of the previous one, and not from the day the new one is issued.

The re-issue or re-key is a different thing. It generally means re-keying an existing certificate order with a different private key and/or CSR. It generally doesn't change the expiration of the certificate, hence it's not a renewal. Both renews and rekeys result in a new certificate (again, it's not possible to change an existing certificate once issued), but the rekey only alters the certificate information and not the expiration.

A renewal can be issued with the same original CSR and key, or with a completely new one. It's up to you.

As in all cases a new certificate is issued, you will have to replace the existing one. Replacing a certificate is generally a no-downtime task. You simply upload the new one, change the server settings and reload them (or restart the server).

Most webservers including Nginx supports hot reloads, therefore you don't need to restart the server and wait for it to reboot.

If planned correctly, the renewal will be a no downtime task.


To get the new one you might or might not need to submit a new CSR, depending on the CA. But in any case you get a new certificate file and need to replace the existing certificate on your server with a new one. See also https://www.digicert.com/ssl-certificate-renewal.htm


Renewal of SSL certificate keeps security on your website alive along with your verified identity. The lapse in renewal can cause a warning on your website and warns your customers to move away from your site.

It depends on the SSL provider that you should continue with old CSR or generate new CSR, but it is recommended to create a new one to get rid of misconfiguration. However, it is a myth that your server will face downtime in the renewal of SSL certificate.

Certificate renewal and re-issuance both are different terms. Certificate renewal happens after the expiry of a certificate, while certificate re-issuance in the case of lost of a private key, want to change the domain/organization name or add new SAN names.

Most certificate providers are sending renewal reminder email frequently before certificate expiry. So, It is advisable to renew your certificate earlier, you can take advantage of getting additional validity period from early renewals.

This article may help you to understand the certificate renewal process. https://www.ssl2buy.com/wiki/how-to-renew-ssl-certificate/