Expressway Server Certificate Renewal

[Richard Pidcock]

I have a scenario where I'm needing to update the server certificate on my Expressway Edges.  The existing GoDaddy certs will expire in October.   I have the renewed certificates from Go Daddy.  I just had them renewed, I did not generate a new CSR.  Is that appropriate; can I just upload the new .PEM file and select the check box for "Re-use my current private key".

Richard W. Pidcock

[Roger Kallberg · Accepted solution]

Yes, but with a note that I actually never done this myself. I always create a CSR when renewing any certificate. That said the outlined process should technically be sound as the private key should remain the same as you have not created a CSR.

[Nithin Eluvathingal]

Have  you received the renewed certificate, with the private key. I’ve had customers renew their certificates without a CSR, where they provide the private key, and I upload both the certificate and the private key for renewal. In this case, a CSR is not required.

If you haven’t received a private key, try the option to reuse the private key. If there’s any mismatch, the new certificate won’t be uploaded, and you’ll need to generate a CSR and get it signed.

[Richard Pidcock]

Thanks guys for the feedback.  I'm planning to upload the renewed certificate tonight so I'll let you know how it goes.

[Richard Pidcock]

Hey guys, just coming back to this a few days later to let you know that things went as expected.  I applied the renewed certificate, checking the box for "Re-use my current private key".  Certificate loaded without issue and all is well.  Thanks again for your help and feedback.

[Bence Hontvari]

This is the only kinda relevant result when you look for the issue "Invalid certificate: The server certificate and private key do not match. Check that you have uploaded the correct files."

I had this when trying to renew certificate while I had created a CSR. Hence the reuse current private key was not an option when trying to renew Server certificate.(And it should not be)

A solution is to
1, Via Winscp or similar program back up the curent private key and csr from tandberg/persistent/certs/generated/crs.
2, Delete both privkey.pem and csr. pem.
3, Resfresh the page Maintenance/Security/Server Certificate.
4, Upload the signed cetificate and the private key you just copied.
5, Profit

[Roger Kallberg]

Nowhere in this thread it says anything about anyone having an issue with invalid certificate and the OP has already reported back how he successfully uploaded the certificate. With that said your response is a little out of context.