How does one change the certificate and key for https
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
We have a server whose original PKI certificate was issued by a discontinued root CA. We have a replacement certificate issued from a different root authority chain. This site was set up some time ago with Strict-Transport-Security established.
The server key is 4096 bits. The old CA root
private key is 1024 bits (it was issued in 2006).
How does one switch PKI keys and certificates for Strict-Transport-Security enabled sites? I have searched for information on this but have so far come up empty.
apache-2.4 ssl-certificate x509
edited 8 hours ago
kubanczyk
10.6k22945
asked yesterday
James B. ByrneJames B. Byrne
1746
add a comment |
We have a server whose original PKI certificate was issued by a discontinued root CA. We have a replacement certificate issued from a different root authority chain. This site was set up some time ago with Strict-Transport-Security established.
The server key is 4096 bits. The old CA root
private key is 1024 bits (it was issued in 2006).
How does one switch PKI keys and certificates for Strict-Transport-Security enabled sites? I have searched for information on this but have so far come up empty.
apache-2.4 ssl-certificate x509
edited 8 hours ago
kubanczyk
10.6k22945
asked yesterday
James B. ByrneJames B. Byrne
1746
add a comment |
We have a server whose original PKI certificate was issued by a discontinued root CA. We have a replacement certificate issued from a different root authority chain. This site was set up some time ago with Strict-Transport-Security established.
The server key is 4096 bits. The old CA root
private key is 1024 bits (it was issued in 2006).
How does one switch PKI keys and certificates for Strict-Transport-Security enabled sites? I have searched for information on this but have so far come up empty.
apache-2.4 ssl-certificate x509
edited 8 hours ago
kubanczyk
10.6k22945
asked yesterday
James B. ByrneJames B. Byrne
1746
We have a server whose original PKI certificate was issued by a discontinued root CA. We have a replacement certificate issued from a different root authority chain. This site was set up some time ago with Strict-Transport-Security established.
The server key is 4096 bits. The old CA root
private key is 1024 bits (it was issued in 2006).
How does one switch PKI keys and certificates for Strict-Transport-Security enabled sites? I have searched for information on this but have so far come up empty.
apache-2.4 ssl-certificate x509
apache-2.4 ssl-certificate x509
edited 8 hours ago
kubanczyk
10.6k22945
asked yesterday
James B. ByrneJames B. Byrne
1746
edited 8 hours ago
kubanczyk
10.6k22945
asked yesterday
James B. ByrneJames B. Byrne
1746
edited 8 hours ago
kubanczyk
10.6k22945
edited 8 hours ago
kubanczyk
10.6k22945
edited 8 hours ago
kubanczyk
10.6k22945
10.6k22945
asked yesterday
James B. ByrneJames B. Byrne
1746
asked yesterday
James B. ByrneJames B. Byrne
1746
asked yesterday
James B. ByrneJames B. Byrne
1746
1746
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
HTTP Strict Transport Security also known as HSTS do not limit use with any other valid certificate.
Are you sure you dont mean HTTP Public Key Pinning (HPKP)
Edit: Just for clarification for HSTS the cert have to be trusted to be counted as valid.
answered yesterday
Aroly7Aroly7
33415
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f962425%2fhow-does-one-change-the-certificate-and-key-for-https%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
HTTP Strict Transport Security also known as HSTS do not limit use with any other valid certificate.
Are you sure you dont mean HTTP Public Key Pinning (HPKP)
Edit: Just for clarification for HSTS the cert have to be trusted to be counted as valid.
answered yesterday
Aroly7Aroly7
33415
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
add a comment |
HTTP Strict Transport Security also known as HSTS do not limit use with any other valid certificate.
Are you sure you dont mean HTTP Public Key Pinning (HPKP)
Edit: Just for clarification for HSTS the cert have to be trusted to be counted as valid.
answered yesterday
Aroly7Aroly7
33415
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
add a comment |
HTTP Strict Transport Security also known as HSTS do not limit use with any other valid certificate.
Are you sure you dont mean HTTP Public Key Pinning (HPKP)
Edit: Just for clarification for HSTS the cert have to be trusted to be counted as valid.
answered yesterday
Aroly7Aroly7
33415
HTTP Strict Transport Security also known as HSTS do not limit use with any other valid certificate.
Are you sure you dont mean HTTP Public Key Pinning (HPKP)
Edit: Just for clarification for HSTS the cert have to be trusted to be counted as valid.
answered yesterday
Aroly7Aroly7
33415
edited yesterday
answered yesterday
Aroly7Aroly7
33415
answered yesterday
Aroly7Aroly7
33415
answered yesterday
Aroly7Aroly7
33415
33415
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
add a comment |
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
Yes. I believe that you are correct. I missed the distinction. I will research that instead.
– James B. Byrne
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
HPKP support was removed from several user agents, but its highly likely your users are still using affected versions. You will have problems until your last header expires from max-age.
– John Mahowald
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
The resolution to that would be to add new header to expire after current last header expires.
– Aroly7
yesterday
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
To clarify our situation. We do not, and never have, used HPKP. I verified that personally. The issue with the certificates was simply that they had expired. The correct solution was to issue a new certificate signing request (CSR) using the existing server public key which was 4096 bits, have the CSR signed by the new trusted CA, and install that certificate in place of the old one.
– James B. Byrne
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
If your certificate already expired then yes, To this point, I thought that you are preparing since your certificate soon expire.
– Aroly7
8 hours ago
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f962425%2fhow-does-one-change-the-certificate-and-key-for-https%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
