Find out if your current CSR can be reused for a SSL renewal. When renewing your SSL certificate, you may wonder if you can reuse your old Certificate Signing Request (CSR). While it is technically possible in some cases, best practice suggests generating a new CSR with each renewal to ensure maximum security and proper compatibility.
Understanding how CSRs work will help you decide the right approach when renewing your SSL certificate.
TABLE OF CONTENTS
What is a CSR?
A Certificate Signing Request (CSR) is a block of encoded text generated on your web server. It contains details about your domain and organisation, and it is required by the Certificate Authority (CA) to issue a SSL renewal certificate.
Each CSR is tied to a private key, which must remain secure on your server. Together, the CSR and private key ensure that your SSL certificate encrypts and secures data correctly.
Can You Use an Old CSR?
Yes, you can reuse your old CSR for SSL renewal if:
- You still have the original private key on the server.
- The domain and organisation details have not changed.
- The server environment has not changed significantly.
However, reusing a CSR is not recommended due to security and compatibility reasons.
Why You Should Generate a New CSR
SSL renewal certificate is a good opportunity to refresh your encryption credentials. Here’s why generating a new CSR is the better choice:
- Improved Security: Each new CSR generates a new private/public key pair. This reduces the risk of using a compromised or weakened key.
- Compliance with Industry Standards: Many modern Certificate Authorities (CAs) require or encourage a new CSR to meet evolving security standards.
- Better Key Management: Rotating your keys regularly, which happens when you generate a new CSR, aligns with good security hygiene and policies.
- Simplified Troubleshooting: Using a fresh CSR can eliminate hidden issues tied to old or incorrectly generated requests.
How to Generate a New CSR
1. Go to the Domains.co.za Login website page.
2. Enter your Email and Password and click the “Sign In” button.
3. You will see the Domains.co.za Dashboard, displaying the Manage Account menu on the left and your Account Information, Account Overview and Open Support Tickets on the right.
4. Click on Manage Services to view the sub-dropdow
5. On the page that follows, click Login to access cPanel.
6. Navigate to Security and select SSL/TLS.
7. Under Certificate Signing Requests (CSR), click Generate, view, or delete CSRs.
8. Fill in your domain and organisation details.
9. Click Generate. The new CSR and private key will be created.
10. Copy the CSR when prompted and use it when renewing your SSL certificate with your Certificate Authority.
Ensure you save your private key securely. You’ll need it when installing the renewed SSL certificate.
Additional Information
Reusing CSRs may seem convenient, but it can result in future complications. Here’s what else you should keep in mind:
Matching the Private Key
If you reuse a CSR but have lost or rotated the private key, the renewed certificate will not work. Always ensure the private key used to generate the CSR is present and secure.
Encrypt and Auto-Renewals
If you’re using Let’s Encrypt or another automated service, a new CSR is usually generated automatically during each renewal cycle. Manual intervention is typically not required.
General CSR Information
- Wildcard & Multi-Domain Certificates: For wildcard or SAN (Subject Alternative Name) certificates, you must ensure the CSR includes all intended domains/subdomains at the time of generation.
- Organisation Validated (OV) & Extended Validation (EV) Certificates: For OV and EV certificates, generating a new CSR may be required if organisational or contact details have changed since the previous issuance.
- Common Issues with Old CSRs: Some Certificate Authorities may reject old CSRs if they’re too old or generated using outdated key sizes (e.g., 1024-bit RSA instead of 2048-bit or higher).
Keep a Record of CSR Details: It’s good practice to record the domains and attributes used when generating a CSR. This makes future renewals smoother, especially in larger or multi-site environments.
