Generate new CSR by referring existing details from current certificate including private key

From Notes_Wiki

Home > Security tips > Generate new CSR by referring existing details from current certificate including private key

This internally refers Openssl. This is not fully tested.

To generate a new CSR from existing certificate and key, then sign it and then import it use:

  1. On existing server with certificate and key, open mmc -> Certificate
  2. Export existing certificate with key in pfx format.
    Need to give a password while exporting with key.
  3. Copy this to a Linux machine with openssl
  4. Convert pfx to PEM using
    openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes
    We need to give password that we gave while exporting key in above steps
  5. Then use OpenSSL to get CSR with exact same details using below command with "- days 3650" additional option to get 10 years validity:
    openssl x509 -x509toreq -days 3650 -in certificate.pem -signkey certificate.pem -out request-new.csr
  6. Validate the output of CSR using:
    openssl req -noout -text -in <csr-file-name>
    to ensure it has:
          Subject: ST=Telangana, OU=IT, O=Rekall, L=Hyderabad, C=IN,	
           Requested Extensions:
                X509v3 Subject Alternative Name:
                X509v3 Key Usage: critical
                    Key Encipherment
    without this we get error of not having DNS SAN or something similar.
    TODO Fix above steps till the csr text output contains proper subject, SAN and key usage
  7. On Active Directory with Certificate Authority to be used for signing the Request, go to regedit to change default issuing validity from 1 year to 10 years
    1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>
    2. Ensure ValidityPeriod is "Years" (Default)
    3. Set ValidityPeriodUnits to 10 in Decimal (Default is 1)
    4. Close regedit
    5. Open "Administrative Command Prompt" and run
      net stop certsvc
      net start certsvc
  8. Then on AD server open Start Menu -> "Windows Administrative Tools" -> "Certificate Authority" in AD server
  9. Right click on CA -> All Tasks -> Submit new request and use the above request
  10. Go to Pending Requests -> All Tasks -> Issue
  11. Go to Issued Certificates -> Open certificate -> Go to Details
    1. Ensure that certificate is valid for another 10 years
    2. click on 'Copy to file' button to export this certificate to import in original server
  12. Copy the exported signed certificate from issuer to Linux machine
  13. On Linux machine convert from der to pem format using:
    openssl x509 -inform der -in certificate.cer -out certificate.pem
  14. Then copy old expiring certificate with key pem format file to a new temporary file (Eg certificate-10-year-with-key.pem)
  15. In this new temporary file remove old server certificate and copy 10 year validity pem certificate in its place (Replace --BEGIN CERTIFICATE-- till --END CERTIFICATE-- only for server. Dont replace private key or CA certificate
  16. In the PEM file we should have before --BEGIN PRIVATE KEY--:
    Bag Attributes
        Microsoft Local Key set: <No Values>
        localKeyID: ...
        friendlyName: ...
        Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
    Key Attributes
        X509v3 Key Usage: 10
  17. In the PEM file before Server certificate we should have values similar to:
  18. Validate the combined pem file:
    openssl crl2pkcs7 -nocrl -certfile certificate-with-10-year-key.pem | openssl pkcs7 -print_certs -noout
  19. Create pfx from the combined pem file using:
    openssl pkcs12 -export -out certificate-with-10-year-key.pfx -in certificate-with-10-year-key.pem
    and give appropriate pfx password
  20. Copy the pfx file to original server from where we exported the first certificate with key
  21. Open mmc -> Certificates -> Local computer -> Import certificate in personal store with password
  22. After import validate the certificate is visible in personal store with 10 year validity
  23. Double click on certificate and in General page near bottom under "Valid from" it must indicate You have a private key that corresponds to this certificate

Home > Security tips > Generate new CSR by referring existing details from current certificate including private key