Reissuing certificates in Certificate Manager - SaaS¶

Reissuing a certificate allows you to replace an existing SSL/TLS certificate while keeping the same order and expiration date. This process is useful for modifying certificate details, such as the common name (CN) or subject alternative names (SANs), or when a private key has been lost or compromised. Certificate Manager - SaaS provides an integrated way to manage certificate reissuance.

Difference between reissuance and renewal¶

While both reissuance and renewal involve obtaining a new certificate, they serve different purposes:

• Reissuance replaces an existing certificate while keeping the original order ID and expiration date.
• Renewal issues a new certificate with an extended validity period, in the process creating a new order ID.

If a certificate is outside its renewal window, Certificate Manager - SaaS attempts reissuance instead. If it is within the renewal window, Certificate Manager - SaaS proceeds with renewal. DigiCert reissues certificates free of charge, however, certificate renewals incur a renewal cost.

If the renewing CA doesn’t recognize the certificate, Certificate Manager - SaaS issues a new certificate using the renewing CA. We sometimes refer to this as net new issuance or standard issuance. This is when you purchase a new certificate, but it is not a renewal of a prior order. In this case, you typically pay the same amount as a certificate renewal, but there is no additional validity period, making this a more expensive option overall.

Certificate reissuance and renewal process¶

When starting the Renew/Reissue wizard in Certificate Manager - SaaS, the following logic determines the certificate request outcome:

1. If outside the renewal window:

   • Certificate Manager - SaaS attempts to reissue the certificate.

   • If reissuance fails, you'll see an error, and the process stops.

     There are several reasons that a reissuance request might fail. For example, if the certificate signing request (CSR) is invalid DigiCert rejects the reissuance request. You need to correct the issue before you'll be able to get the certificate reissued.

     Exception: If reissuance fails because the original certificate is not found at the CA, Certificate Manager - SaaS automatically proceeds with standard issuance. This process, known as CA agility in Certificate Manager - Self-Hosted, enables transitioning a certificate from one CA to another.

2. If inside the renewal window:

   • Certificate Manager - SaaS attempts to renew the certificate.

   • If renewal fails for any reason, Certificate Manager - SaaS automatically falls back to standard issuance without any user intervention.

3. Standard certificate issuance:

   • This is the default (and most expensive) option.

   • It applies when neither reissuance nor renewal is successful.

The following diagram illustrates this decision process:

graph TD
    A(["⮕ Certificate renewal/reissue initiated"]) -->|Outside renewal window?| B{"Outside window?"}
    B -->|Yes| C["Attempt reissuance"]
    B -->|No| D["Attempt renewal"]

    C -->|Reissuance fails?| E{"Reissuance fails?"}
    E -->|Yes| F["Report error to client"]
    E -->|Exception: Cert not found at CA| G["Proceed with standard issuance"]
    E -->|No| H["Reissuance successful"]

    D -->|Renewal fails?| I{"Renewal fails?"}
    I -->|Yes| J["Proceed with standard issuance"]
    I -->|No| K["Renewal successful"]

Setting the renewal window¶

• DigiCert: Defaults to 32 days; accepts 1 to 397 days. Set the window when configuring the DigiCert CA connection.

• Sectigo Certificate Manager: Defaults to 32 days; accepts 1 to 397 days. Set the window when configuring the Sectigo Certificate Manager CA connection.

• GoDaddy: Defaults to 32 days; accepts 1 to 90 days. Set the window when configuring the GoDaddy CA connection.

Reissuing Sectigo Certificate Manager certificates¶

When you reissue a Sectigo Certificate Manager certificate, Certificate Manager - SaaS keeps the original Sectigo order and links the new certificate to the one it replaces, so the relationship is visible in both the Sectigo portal and Certificate Manager - SaaS.

• You can remove subject alternative names (SANs) during reissuance, where the Sectigo Certificate Manager API allows it.
• Certificate Manager - SaaS logs Sectigo Certificate Manager reissuance and renewal as separate events, so an audit trail distinguishes a reissued certificate from a renewed one.
• If Sectigo Certificate Manager rejects a reissuance request — because of an account-level restriction, for example — the error returned by the CA is recorded in the activity log.

Reissuing GoDaddy certificates¶

GoDaddy treats reissuance and rekey as the same operation. Reissuing a GoDaddy certificate replaces the certificate while keeping the original GoDaddy order, and also rekeys it if your certificate signing request (CSR) contains a new key pair.

What a GoDaddy reissuance can and cannot change¶

Other GoDaddy reissuance considerations¶

• The certificate must have a GoDaddy certificate ID. GoDaddy addresses certificates solely by its own certificate ID and offers no lookup by serial number or fingerprint. Certificates issued or imported through the GoDaddy connector carry that ID and can be reissued. Certificates that entered Certificate Manager - SaaS another way, such as through discovery, manual upload, or non-GoDaddy import, do not have it, so reissuance requests for them fail.
• Reissuances are unlimited. There is no quota on how many times you can reissue a GoDaddy certificate.
• Retrying is safe. Submitting a reissuance while another is still pending replaces the pending request; GoDaddy rejects the earlier one automatically, so duplicate orders do not accumulate.
• Install the replacement within 72 hours. GoDaddy revokes the certificate being replaced 72 hours after it issues the replacement. Install the new certificate before then to avoid an outage.
• CA errors are logged. If GoDaddy rejects a reissuance, for example because the certificate is in a state that does not permit it, the error returned by the CA is recorded in the activity log.

Reissuing a certificate¶

To reissue a certificate, follow the steps in Renewing a certificate manually. If the certificate is outside the renewal window, Certificate Manager - SaaS automatically reissues it instead of renewing it, since the reissuance option is free of charge.

You cannot change a certificate’s expiration date through reissuance. No matter what expiration you enter in the wizard, the new certificate will retain the original certificate’s expiration date. Certificate Manager - SaaS first checks whether the certificate is in the renewal window. If it is, the certificate is renewed based on the renewal wizard settings. If it is outside the renewal window, it is automatically reissued with the original order's expiration date.

Logging and auditing¶

Certificate Manager - SaaS logs reissuance events separately from renewals and new certificate requests, providing visibility into certificate lifecycle changes. This helps administrators track when and why a certificate was reissued and ensures compliance with security policies.

For details on viewing the event log, see event logging.

Other reissuance notes and considerations¶

When to reissue a certificate¶

Reissuance is typically used in the following scenarios:

• Lost or compromised private key – If the private key associated with a certificate is lost or no longer accessible, reissuance allows you to generate a new key pair and obtain a new certificate.
• Modifying certificate details – You can update the common name (CN) or adjust subject alternative names (SANs) while keeping the existing order.
• Operational needs – If an existing certificate needs replacement due to configuration changes, reissuance provides a seamless way to do so without affecting the certificate order.

DigiCert provides reissuance as a free service for certificate owners.

Security considerations for reissuance¶

While reissuance is a flexible option, follow these security best practices:

• Key management – If a private key is lost, generate a new key pair during reissuance to prevent unauthorized access.
• Key compromise – If a private key is suspected to be compromised, revoke the certificate instead of reissuing it. Revocation ensures the compromised certificate is no longer trusted by clients and servers.

When DigiCert reissues a certificate, the original certificate is marked as revocation pending, and the original certificate is no longer valid.

When revocation is required instead of reissuance¶

Reissuance is not an option if a certificate has already been revoked. Revocation permanently invalidates a certificate, requiring a new certificate request. This is particularly important in cases of key compromise, where an attacker may still possess the private key even after reissuance.

Related information¶

• Adding a DigiCert certificate authority
• Create a Sectigo Certificate Manager certificate authority
• Create a GoDaddy certificate authority
• Renewing certificates
• Event logging
• DigiCert's reissuance documentation