Create new CSR without removing existing certificate

Discussion in 'ISPConfig 3 Priority Support' started by Jemt, Jun 11, 2022.

  1. Jemt

    Jemt Member HowtoForge Supporter

    Hi,
    I have a website with a wildcard certificate expiring in a couple of days.
    The company I'm buying certificates from (a RapidSSL reseller) does not provide support for renewing certificates, but instead asked me to simple buy a new one. However, the name of my company was recently changed, so I can't reuse the existing CSR - so what do I do? How can I create a new CSR with the new company name, without breaking the existing SSL configuration?

    - Thank you

    Best regards
    Jimmy
     
  2. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    When you get the new cert details from them, open the SSL tab, delete the old certificate (clear the fields and select delete cert as action), then fill in the new info and select save certificate.
     
  3. Jemt

    Jemt Member HowtoForge Supporter

    @Th0m I can't request a new certificate without a CSR, and I suspect that choosing the option "Create certificate" in "SSL Action" will wipe the existing certificate or make it invalid when I change the company name. Is there somehow else I can create a CSR with ISPConfig? Perhaps on the command line? There are many articles describing how to create certificates using OpenSSL (e.g. this: https://www.digicert.com/kb/csr-ssl-installation/ubuntu-server-with-apache2-openssl.htm) - I'm just not sure whether it will work with ISPConfig.
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    You'll have to create the csr on the shell using openssl in this case indeed, there is no way to create it in ISPConfig without overwriting the currently active cert and key.
     
  5. Jemt

    Jemt Member HowtoForge Supporter

    Thanks @till :)
    For others (and myself in the future), this is what I did:
    1) Create a new CSR using the following command:
    Code:
    openssl req -new -newkey rsa:2048 -nodes -out star_domain_com.csr -keyout star_comain_com.key
    2) Answer the following questions: Country, Locality Name, Organization Name, Common Name (*.domain.com for a wildcard certificate, domain.com or www.domain.com for an ordinary SSL certificate). Answer all other questions with a dot (.) which means "empty".
    3) Verify that the CSR contains the correct information:
    Code:
    openssl req -in star_domain_com.csr -noout -text
    Check the subject field which must contain the correct country code, city name, company name, and domain name (common name).
     
    till likes this.

Share This Page