Skip to main content

Hello,

We are coming up to our certificate renewal, and I noticed that the BeyondTrust documentation states “You do not need to create a new certificate request”, and to provide the original CSR if the CA doesn’t already have it. 

 

See DigiCert documentation, “Best practice is to generate a new CSR when renewing your SSL/TLS certificate. This creates a new, unique keypair (public/private) for the renewed certificate.” 

 

Why would BeyondTrust, a company developing security products, recommend a less secure process? Am I misunderstanding something, or should the BeyondTrust documentation follow industry best practices for renewing certificates which is to generate a new CSR in order to create a new keypair? 

I think the confusion lies in “renewing” vs “getting a new one”.  If you want to renew the current cert, and keep all of it’s current information and security methods, then you wont have to create a new CSR because you’re renewing the one you currently have.  That’s why the sentence directly before the one you pasted in denotes that cert renewals use the old cert’s data - because that’s what you’re doing, just renewing the one you have:

“When a certificate is renewed, the original certificate data is used. You do not need to create a new certificate request, and no new intermediate or root certificates need to be installed.”

If you would like a new cert with the current security technologies, you’ll need to create a new CSR.  

BT isnt saying you SHOULD do it, they’re saying “if you want to, here is how you do it”, but if you scroll down, it also tells you how to create a new CSR and install it.

Speaking personally, I would argue that the industry’s usage of the word “renew” is misleading.  When you go to the library to “renew” a book, you dont leave with a completely different book.  You leave with the same one.  I’ve always used the term “Update the certs” for accuracy purposes.


Reply