1

One of our production certs is expiring on Nov 27. A CSR to renew that cert was generated two days ago on Nov 10, and my co-worker now says that because it was generated too fast we cannot process other certificates BEFORE taking care of this one first. This is what he said:

"CSR is already created, which means we can’t process any other cert renewal until this one is completed first."

This got me confused, in that the cert can be renewed anytime before Nov 27th so what is the dependecy between this cert and other certs that may need to be renewed? Is he correct to say that?

P.S. All of our certs are hosted on the same webservers and we have 2 of those servers. We are using IBM https servers (IHS) and the admin console was used to generate the CSR.

1

If you have explained your co-workers assertions correctly, he is incorrect.

CSR's do relate to a single set of certificates and do not affect your ability to create other certs with other CSR.

A CSR is a signing request, and they are not really time critical - indeed for the most part any date/validity period in a CSR is ignored. The important parts are the public key derivative of the private key and information about the domains it covers. (Its not recommended but if you don't modify the private key you can reuse an old CSR!)

There is an edge case where he might be correct - if you have a single cert which has multiple domains associated with it it is possible that there are time-related issues - but that presupposes multiple domain names use a single cert which is not great design or required since Windows XP was made obsolete.

2
  • Thanks! Appreciate it.
    – Faiz
    Nov 13 '20 at 12:43
  • "do not affect your ability to create other certs with other CSR." Technically yes, but for other reasons of policy a given CA can refuse to accept any new CSR before any pending one is fullfilled (with the relevant certificate being created). Nov 19 '20 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.