17.3. Renewing Subsystem Certificates There are two methods of renewing a certificate. Regenerating the certificate takes its original key and its original profile and request, and recreates an identical key with a new validity period and expiration date. Re-keying a certificate resubmits the initial certificate request to the original profile, but generates a new key pair. Administrator certificates can be renewed by being re-keyed. 17.3.1. Re-keying Certificates in the End-Entities Forms Subsystem certificates can be renewed directly in the end user enrollment forms, using the serial number of the original certificate. Renew the certificates in the CA's end-entities forms, as described in Section 5.4, "Renewing Certificates" . This requires the serial number of the subsystem certificate being renewed. Import the certificate into the subsystem's database, as described in Section 17.6.1, "Installing Certificates in the Certificate System Database" . The certificate can be imported using certutil or the console. For example: 17.3.2. Renewing Certificates in the Console The Java subsystems can renew any of their subsystem certificates through their administrative console. The process is exactly the same as requesting new subsystem certificates ( Section 17.2, "Requesting Certificates through the Console" ), with one crucial difference: renewal uses an existing key pair rather than generating a new one. Figure 17.1. Renewing Subsystem Certificate After renewing a certificate, then delete the original certificate from the database ( Section 17.6.3, "Deleting Certificates from the Database" ). 17.3.3. Renewing Certificates Using certutil certutil can be used to generate a certificate request using an existing key pair in the certificate database. The new certificate request can then be submitted through the regular profile pages for the CA to issue a renewed certificate. Note Encryption and signing certificates are created in a single step. However, the renewal process only renews one certificate at a time. To renew both certificates in a certificate pair, each one has to be renewed individually. Get the password for the token database. Open the certificate database directory of the instance whose certificate is being renewed. List the key and nickname for the certificate being renewed. In order to renew a certificate, the key pairs used to generate and the subject name given to the new certificate must be the same as the one in the old certificate. Copy the alias directory as a backup, then delete the original certificate from the certificate database. For example: Run the certutil command with the options set to the values in the existing certificate. The difference between generating a new certificate and key pair and renewing the certificate is the value of the -n option. To generate an entirely new request and key pair, then -k sets the key type and is used with -g , which sets the bit length. For a renewal request, the -n option uses the certificate nickname to access the existing key pair stored in the security database. For further details about the parameters, see the certutil (1) man page. Submit the certificate request and then retrieve it and install it, as described in Section 5.3, "Requesting and Receiving Certificates" . 17.3.4. Renewing System Certificates Certificate System does not automatically renew system certificates online while the PKI server is running. However, if a system certificate expires, Certificate System will fail to start. To renew system certificates: If the system certificate is expired: Create a temporary certificate: Import the temporary certificate into Certificate System's Network Security Services (NSS) database: Start Certificate System: Display the certificates and note the ID of the expired system certificate: Create the new permanent certificate: Stop Certificate System: Import the new certificate to replace the expired certificate: Start Certificate System:

Commands:
certutil -A -n "ServerCert cert-example" -t u,u,u -d /var/lib/pki/ instance_name /alias -a -i /tmp/example.cert
cat /var/lib/pki/ instance_name /conf/password.conf internal=263163888660
cd /var/lib/pki/ instance_name /alias
certutil -K -d . certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 69481646e38a6154dc105960aa24ccf61309d37d caSigningCert cert-pki-tomcat CA
certutil -D -n "ServerCert cert-example" -d .
certutil -d . -R -n "NSS Certificate DB:cert-pki-tomcat CA" -s "cn=CA Authority,o=Example Domain" -a -o example.req2.txt
pki-server cert-create sslserver --temp
pki-server cert-import sslserver
pki-server start instance_name
pki-server cert-find
pki-server cert-create certificate_ID
pki-server stop instance_name
pki-server cert-import certificate_ID
pki-server start instance_name