After the purchase
How to Reissue an SSL Certificate (New Key, Added Domains, Lost Key)
A reissue gives you a fresh certificate inside the term you already have. Here is when you need one, what it requires and how to do it step by step.
What it means to reissue an SSL certificate
To reissue an SSL certificate means asking the certificate authority (CA) for a new certificate under the order you already have, usually with a new private key. You do not buy a new term. The new certificate replaces the old one on your server.
You reissue when something about the certificate or its key changes: the key is lost, you move to a new server, or you need a different set of domain names. As maximum certificate lifetimes get shorter, reissues within a multi-year plan also become routine.
Most reissues take four steps: create a new CSR (certificate signing request, the file that carries your public key and domain names), submit it, complete validation and install the new certificate.
Start with a fresh CSR
A new key pair is the cleanest basis for every reissue. Create your CSR and private key, then paste the CSR into your reissue request.
Create a new CSRWhat is the difference between reissue and renewal?
A reissue is a new certificate within the term you already paid for; a renewal starts a new term. Revocation is a third action: it invalidates a certificate before it expires.
| Action | What changes | Typical trigger | New purchase? |
|---|---|---|---|
| Reissue | New certificate, often new key or new names, same order | Lost key, new server, changed domains, shorter lifetimes | No |
| Renewal | New term and new certificate | The paid term is ending | Yes |
| Revocation | Existing certificate is marked invalid | Key compromise, wrong data, no longer needed | No |
When your term ends or a certificate already expired, follow the steps to renew an SSL certificate. If a key may have leaked, you will also want to revoke an SSL certificate after the replacement is live.
When do you need to reissue?
Lost or missing private key
The certificate is useless without its key. If the key file is gone, reissue with a new CSR.
New server or platform
Moving hosts or load balancers? Generate the key on the new system and reissue there.
Added or changed names
Need another SAN (subject alternative name) on a multi-domain product? Reissue with the updated list.
Shorter lifetimes
On a multi-year plan, each certificate expires before the plan does. You reissue to cover the rest of the term.
Reissue triggers in more detail
Private key missing
An “SSL certificate private key missing” error usually means the key stayed on the server that created the CSR. You cannot download a private key from the CA, because the CA never had it. If you cannot find the key file, the only fix is a reissue with a new key.
Lifetime shortening
As of October 2026, a public TLS certificate can be valid for at most 200 days, under CA/Browser Forum ballot SC-081. The limit drops to 100 days from March 15, 2027 and 47 days from March 15, 2029. A “1-, 2- or 3-year” plan is therefore a subscription term: each certificate covers part of it, and you reissue to continue. Check your order details for the reissue terms that apply to your product.
Tip: Keep the old certificate and key in place until the new certificate is installed and tested. Reissuing does not switch off the old certificate, so there is no reason to remove it early.
Do I need a new CSR for a reissue?
A new CSR with a new private key is recommended for every reissue, and it is required when the key is lost or may be exposed. Reusing the old key is sometimes possible, but it carries the old key’s risk into the new certificate.
Searches for “new cert, same key” usually come from people who want to skip the CSR step. Some CAs accept a resubmitted CSR with the same key, others reject or discourage it, so check your CA’s rules before you rely on it. Never reuse a key that left your control.
| Situation | Same key acceptable? | Recommendation |
|---|---|---|
| Key lost or deleted | Not possible | New key and CSR |
| Key may be exposed or compromised | No | New key and CSR, then revoke the old certificate |
| Moving to a new server | Possible, but means copying the key | Generate a new key on the new server |
| Adding domain names | Depends on the CA | New CSR listing all names |
| Routine reissue within the term | Depends on the CA | New key as good practice |
The CSR must contain the names you want covered. For field-by-field guidance, use our CSR generator, which also explains the common name.
How to reissue an SSL certificate
Create a new key and CSR
Generate them on the server that will use the certificate. Store the private key securely; it never leaves that server.
Submit the reissue request
Open your certificate order, choose reissue, paste the new CSR and update the domain list if your product allows it.
Complete validation
Approve the domain control check by email, DNS record or HTTP file if the CA asks for it. Organization checks may be reused.
Install and test
Install the new certificate with its intermediate chain, reload the server and check the result in a browser or checker tool.
Does a reissue need new validation?
Only if earlier validation is too old or covers different names. The CA can reuse a completed domain control validation (DCV) for a limited time; any newly added domain must always be validated.
As of October 2026, DCV results can be reused for up to 200 days. Organization details for OV and EV certificates can be reused for up to 398 days since March 15, 2026. The DCV window keeps shrinking:
- From March 15, 2026: up to 200 days of DCV reuse.
- From March 15, 2027: up to 100 days.
- From March 15, 2029: up to 10 days.
In practice, a reissue soon after the original order often goes through without new DCV. A reissue months later, or one that adds names, will ask you to approve domain control again.
Common reissue problems and fixes
| Problem | Cause | Fix |
|---|---|---|
| “Private key does not match certificate” | New certificate installed with the old key, or the other way round | Install the certificate together with the key from the new CSR |
| Key not found on new server | CSR was created on a different machine | Reissue again with a CSR created on the target server |
| New domain missing from certificate | Name not in the CSR or not added to the order | Add it to the order and the CSR, then reissue |
| Reissue stuck in “pending” | Domain control check not completed | Approve the email, DNS or HTTP validation |
| Browser still shows old certificate | Server not reloaded, or another server or CDN serves the old one | Reload the service and update every endpoint |
For server-specific steps, see how to install an SSL certificate, including chain files and multiple certificates on one server.
Ready to reissue?
Create a new private key and CSR on the server that will use the certificate, then submit it with your reissue request.
Create a new CSR