When I renew a certificate, does the old one get revoked?

Help
1

Hi;

Out of interest, what happens when a certificate is renewed, does the old one get revoked automatically? I guess, I am trying to see if a certificate renewal could be a better alternative to revoking then renewing.

Kindly
Wasfi

2
3 Likes
3

A "renewal" certificate is just a convenient term for a new certificate that happens to share the same set of SANs as a previously-issued certificate. Beyond labeling that relationship, there is no operational correspondence between the "original" and "renewed" certificates.

6 Likes
4

So no, renewing a cert doesn't revoke the old one, and you shouldn't revoke the old one--just let it expire. Only revoke a cert if you suspect its private key has been compromised.

7 Likes
5

The animated post I shared is a colorful version of exactly what @danb35 has correctly advised.

4 Likes
6

But how can renew and let the old one expire as the old one will not exist. The new one simple overwrite it as far as I know.

7

The old certificate will ALWAYS exist, even after you've deleted it locally. :wink:

5 Likes
8

Once you've destroyed a certificate's private key, that certificate will continue to "exist" (even if you delete it), but it won't ever be usable again.

5 Likes
9

I'm sure it depends on the client, but with the most popular ones (certbot, acme.sh, etc.), this isn't true. A new cert is issued, but it doesn't overwrite the old one. And if the old one were overwritten, what then? It can't be used again, so (once again) there's no reason to revoke it.

Again, the only reason to revoke a cert is if you suspect the private key has been compromised.

7 Likes
10

Thank you @griffin and @danb35

4 Likes
11

And to complete this thread in total, in addition to:

and

There are 2 (3?) ways to revoke a certificate:

  • Using the private key associated with the certificate itself;
  • Or, if the private key isn't around any longer, using the ACME account which issued the certificate in the first place or (/and?) a different ACME account, but which has proven authority of (all) the hostname(s) in the certificate.
3 Likes
12

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.