Renewing certificates

Certificates expire, and the details they carry go out of date. A manual renewal issues a replacement for a certificate you already have, and lets you correct it at the same time: add a name the service now answers to, extend the validity, or decide whether the replacement keeps the current key pair. This is the counterpart to automatic renewal, which renews a certificate exactly as it is on a schedule. Reach for a manual renewal when something about the certificate needs to change, or when you want the replacement now rather than at the next renewal window.

A certificate can be renewed when it was issued from a certificate profile, is still active, and hasn’t already been renewed. Certificates obtained through ACME, EST, or SCEP are renewed by the client that requested them, not from here.

How a renewal is built

The renewed certificate starts as an exact copy of the one being renewed. Only what you explicitly change is different.

What you do	What happens
Leave a field alone	The current value carries over
Change a field	The new value is used
Clear a field	The attribute is dropped from the renewed certificate
Edit a list, such as names or key usages	The list you submit replaces the current one

Defaults configured on the certificate profile are deliberately not applied. They describe what a new certificate should look like, so applying them during a renewal would rewrite fields you never touched. The profile’s certificate policy still validates the result, so a renewal can’t produce a certificate the policy would have rejected at issuance.

Choosing how the key pair is handled

The first step of the renewal asks how to handle the key pair. This is the one decision that can’t be changed afterwards, because it determines the key the replacement certificate certifies.

Option	What happens
Reuse the existing key pair	The renewed certificate carries the same public key. Anything pinned to that key, such as a key-pinned client or a device that can’t rotate its key, keeps working.
Generate a new key pair	A fresh key pair is created for the renewed certificate. This is the default.
Use a CSR	You supply a certificate signing request with its own key.

Reusing a key pair extends the lifetime of that key by another full validity period. If the key were ever exposed, a renewal that reuses it carries the exposure forward. Prefer a new key pair unless something in your environment depends on the current one.

Availability by issuer

Not every option applies to every certificate. The renewal wizard greys out the ones that don’t, and explains why.

Issuer	Reuse the key pair	Use a CSR
Private CA	Yes	Yes
External CA	No, these CAs only accept a freshly generated key	Yes
Self-signed	Yes	No, see below

A self-signed certificate is signed by the private key that matches its own public key. A signing request carries only a public key, so there would be nothing to sign the renewal with. Reuse works because the existing key pair is available to sign with.

Certificates issued through Active Directory Certificate Services or Azure AD CS take their validity, key usages, extended key usages and basic constraints from the CA’s own certificate template. The renewal wizard hides those fields for such certificates, because anything set here would be discarded by the CA. You can still change the subject and the alternative names.

Reuse is available for certificates issued with an Infisical-managed key pair. A certificate you issued from your own signing request can reuse its public key too: the renewal is made from that original request, so the key stays on your side.

What you can change

Property	Notes
Subject attributes	Common name, organization, organizational unit, country, state, locality, domain components
Subject alternative names	Add, remove, or change the type of any name
Validity	A duration such as `90d`, `12h`, or `1y`
Key and signature algorithm	Locked to the current key algorithm while reusing the key pair, because the key already exists
Key usages and extended key usages	Constrained to what the certificate policy allows
Basic constraints	Whether the certificate is a CA, and its path length
Custom extensions	Object identifiers and values, constrained to what the certificate policy allows

Changing the common name can affect certificate syncs that select certificates by name. Check any sync attached to the certificate before renaming it.

Permissions

Renewing a certificate as it stands needs only permission to issue from its certificate profile. Changing any of the properties above additionally needs Edit on certificates, so a role scoped to issuance alone can keep certificates current without being able to alter what they contain. A DigiCert reissue that removes or changes a name also needs permission to revoke the certificate, because DigiCert revokes the previous one.

Renewing from a signing request

When you supply a CSR, that request is the source of truth for the subject and the key, so there are no separate fields for them. The validity, the basic constraints and the custom extensions are set alongside it, and custom extensions keep their current values unless you change them. Sending a property the CSR already carries is rejected rather than quietly ignored, so a renewal never silently discards something you asked for.

Reissuing a DigiCert certificate

If a DigiCert CA issued the certificate, you can reissue it on the same DigiCert order instead of placing a new order. A reissue uses the order you already paid for, for example to replace an exposed key or to change the names on the certificate. On the first step of the renewal, select Reissue the existing order under DigiCert order. A reissue requests the same validity as the current certificate, capped at 199 days and at the end of the order, so the Validity (TTL) field is read-only and the API rejects ttl. The profile’s policy still applies to it, so a validity the policy doesn’t allow is flagged before you submit. If you need a certificate that lasts longer than the order, select Place a new order instead. If you add a name that DigiCert hasn’t validated yet, validate it in DigiCert CertCentral within 24 hours. Otherwise the reissue is canceled and the request fails. Automatic renewal always places a new order. To reissue on the existing order, renew the certificate manually.

If the reissue removes or changes a name, DigiCert revokes the previous certificate and any earlier copies on the order within 72 hours, so you also need permission to revoke the certificate.

Renewing a certificate

Web UI
API

Open the certificate

Go to the Certificates tab of your Application and select the certificate you want to renew.

Start the renewal

Open the Options menu and choose Renew Now.

Choose how the key pair is handled

Pick one of the three options above. For a DigiCert certificate, also choose whether to place a new order or reissue the existing one. If you chose Use a CSR, paste it on the next step and you’re done.

Adjust the subject and names

The subject attributes and alternative names are filled in from the current certificate. Change only what should differ.

Set validity and extensions

Adjust the validity, algorithms, key usages, and basic constraints.

Review the custom extensions

The custom extensions are filled in from the current certificate. Change only what should differ, then select Renew certificate.

Infisical opens the renewed certificate when it is issued.

Renew a certificate and change the properties you want in the same request. Everything you leave out is copied from the current certificate.

curl -X POST "https://app.infisical.com/api/v1/cert-manager/certificates/<certificate-id>/renew" \
  -H "Authorization: Bearer <your-access-token>" \
  -H "Content-Type: application/json" \
  -d '{
        "renewalKeySource": "reuse",
        "attributes": {
          "commonName": "api.example.com",
          "altNames": [
            { "type": "dns_name", "value": "api.example.com" },
            { "type": "dns_name", "value": "api-internal.example.com" }
          ],
          "ttl": "90d"
        }
      }'

renewalKeySource accepts new, reuse, or csr. Supply csr alongside renewalKeySource: "csr". To clear an attribute, send it as null.To reissue a DigiCert certificate on its current order, send "externalConfiguration": { "reissue": true } and leave out ttl.A request with no body renews the certificate as it is with a new key pair, so existing automation keeps working unchanged.See the Renew Certificate endpoint for the full request and response.

After a renewal

The renewal produces a new certificate with its own serial number, linked to the one it replaced.

The previous certificate reports a status of Renewed rather than Active, and links to its replacement under Renewed by. The replacement links back under Renewed from.
The previous certificate stays valid until its own expiry, so you can roll over on your own schedule. The exception is a DigiCert reissue that removes or changes a name: DigiCert revokes the previous certificate within 72 hours. The previous certificate can’t be renewed a second time.
Because it’s no longer the current certificate, it drops out of the active count on the dashboard and out of expiry alerts. Filter the inventory by the Renewed status, or open the Renewed view, to list every certificate that has been superseded.
Metadata carries over to the renewed certificate.
Certificate syncs attached to the certificate move to the renewed one and push it to their destinations.
Automatic renewal carries over. A certificate set to renew 4 days before expiry keeps that window, measured against the renewed certificate’s own expiry rather than the previous one.

The window is re-derived for the renewed certificate’s validity, so it can come back smaller. Renew a 30 day certificate that renews 20 days early into a 5 day one and the window shrinks to fit, because it has to stay shorter than the certificate it applies to.

Deploy the renewed certificate before the previous one expires. Renewing doesn’t revoke the certificate it replaces, so if the old one was compromised, revoke it explicitly. The exception is a DigiCert reissue that removes or changes a name, where DigiCert revokes the previous certificate within 72 hours.

FAQ

Does renewing revoke the certificate it replaces?

No, unless a DigiCert reissue removes or changes a name. The previous certificate stays valid until its own expiry date, which gives you a window to deploy the replacement. If you need the previous certificate to stop being trusted immediately, revoke it, and it will appear in the issuing CA’s CRL.

Why is the key algorithm locked when I reuse the key pair?

The algorithm is a property of the key itself, so it can’t change while the key stays the same. To move from RSA to an elliptic curve key, or to a larger key size, renew with a new key pair.

What happens if the certificate policy changed since the certificate was issued?

The renewal is validated against the policy as it is now, so a certificate that no longer satisfies the policy is rejected with a message naming the field at fault. Adjust the values during the renewal so they fit the current policy.

Can I renew a certificate that Infisical did not generate the key for?

Yes. Choose a new key pair, or supply a CSR generated from the existing key. A certificate issued from a signing request can also reuse its public key, in which case the renewal is made from that original request.

Where can I see why a renewal failed?

If a manual renewal fails, Infisical shows the reason when you submit it and records a certificate-issuance-failed audit log event that links to the certificate being renewed. If an automatic renewal fails, Infisical records an automated-renew-certificate-failed event instead, unless the renewal had already been sent to an external CA, in which case the failure is recorded as certificate-issuance-failed.

Can I renew several certificates at once?

Manual renewal handles one certificate at a time. To keep many certificates current without intervention, enable automatic renewal so they renew before they expire.

What’s next?

Certificates

Inspect, export, and revoke certificates in your inventory.

Certificate Syncs

Push renewed certificates to their destinations automatically.

Alerting

Get notified before certificates expire.

Certificate Policies

Constrain what a renewed certificate may contain.

Get started

Certificate authorities

Managing certificates

Monitoring

Code signing

Renewing certificates

How a renewal is built

Choosing how the key pair is handled

Availability by issuer

What you can change

Permissions

Renewing from a signing request

Reissuing a DigiCert certificate

Renewing a certificate

After a renewal

FAQ

What’s next?

Certificates

Certificate Syncs

Alerting

Certificate Policies

​How a renewal is built

​Choosing how the key pair is handled

​Availability by issuer

​What you can change

​Permissions

​Renewing from a signing request

​Reissuing a DigiCert certificate

​Renewing a certificate

​After a renewal

​FAQ

​What’s next?

Certificates

Certificate Syncs

Alerting

Certificate Policies

How a renewal is built

Choosing how the key pair is handled

Availability by issuer

What you can change

Permissions

Renewing from a signing request

Reissuing a DigiCert certificate

Renewing a certificate

After a renewal

FAQ

What’s next?