Ssl csr renew - update

Hi there, I have a custom SSL that i bought over a year ago and i implemented it on the mail section. ( I do not use hestia for the website )
Now i do not have the CSR file and I need it in order to re issue a new one for the email domain. What do you guys suggests me I should do in order to get a CSR file, make the new SSL cert and make it work on the email? Thanks a lot in advance.
Big shoutout to Jaap

Hi @ddoscomin,

My recommendation is that you ask to your certificate provider to know what are the steps you should follow.

Anyways, if you are using openssl version 3 (openssl version to view the version installed) you can create the certificate from your existing certificate (if you want the new certificate to have the same data as the current one).

Let’s say that your domain is and your hestia user is ddoscomin.

Create csr from your current cert and key.

openssl x509 -x509toreq -copy_extensions copyall -in /home/ddoscomin/conf/mail/ -signkey /home/ddoscomin/conf/mail/ -out /tmp/

Now you could send /tmp/ to your certificate provider so they can sign in and send back your certificate.

Note: you can view the csr with this command:

openssl req -in /tmp/ -noout -text

Once you get your cert, just replace /home/ddoscomin/conf/mail/ with the new cert and you should also recreate /home/ddoscomin/conf/mail/ with your new cert and the intermediate(s) CA that your provider is using… if any.

Once done you should restart exim4 and dovecot.

Note: always keep a backup of your current cert and key… just in case.

You could also create a new csr from scratch and create also a new key if you don’t want to reuse the existing one but there are tons of sites that explain that over there.

Hi @sahsanu !
Thank you so much for your comprensive and detailed answer. It was exactely what i was looking for.
I am unfortunately having an issue with the command. I tried researching around before braking your balls but seems I can’t find something usefull.
Once i try to create the csr from the current i cert i get:

x509: Unrecognized flag copy_extensions
x509: Use -help for summary.

Thanks again bro.

As I said, your openssl version should be 3+

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.