Skip to main content

Reissue a certificate

Reissue generates a fresh private key and requests a new certificate from the same issuer with the same subject / SANs. It is the right choice when you suspect key compromise, when you want to change the key algorithm (e.g. RSA 2048 → ECDSA P-256), or when policy mandates periodic key rotation independent of the expiry-driven renewal cadence.

Not available for imported certificates

Reissue requires a CA to re-request from. Imported (bring-your-own) certificates have no issuing CA, so Re-issue is rejected for them — the refresh path is Re-import (upload a fresh certificate).

Reissue vs. renew​

RenewReissue
Triggered byExpiry window / schedulerExplicit operator action
Private keyReused by default — a new key only when the certificate's key-rotation policy is set to rotateAlways NEW
Subject / SANsSameSame
IssuerSameSame
Use caseScheduled lifecycleKey compromise, policy, algorithm change

The key is the important difference. Renewal reuses the existing private key unless the certificate opts into rotation, so waiting for a scheduled renewal after a suspected key compromise would leave the compromised key live. Reissue always generates a new key pair.

The other distinction is timing: reissue fires now, regardless of the renewal window and regardless of ARI hints.

After a key compromise, reissue — do not wait for renewal

Renewal keeps the same private key by default. If you suspect the key is exposed, reissue immediately (and revoke the old certificate), rather than relying on the next scheduled renewal to replace it.

When to use reissue​

  • Key compromise. Followed immediately by revocation of the old cert.
  • Algorithm upgrade. Moving from RSA 2048 to ECDSA P-256 fleet-wide; reissue with the new key type, then revoke the old on completion.
  • Deployment proof. Some change-management workflows require a fresh issuance after infrastructure reconfiguration — reissue gives a clean audit boundary.
  • A first issuance that failed. A certificate tagged Issuance failed never got a certificate: the last attempt failed and nothing is retrying it. Its status stays pending because that is what it is, so reissue is how you start another attempt once the cause in Last Error is fixed.
  • Stuck renewal state. If a certificate keeps landing in renewal_failed (the safety net retries it automatically, but the root cause may make every attempt fail), reissue is the clean way to restart the lifecycle without clearing state manually.

Trigger a reissue​

  1. Open the certificate detail page.
  2. Click Reissue (top-right actions).
  3. Confirm. There are no options — the key type and every other setting are inherited from the existing certificate.
  4. An issue_certificate job enqueues (msca_issue_certificate for AD CS-issued certificates). There is no reissue_certificate job type, so do not look for one on the Jobs page.

What happens​

  1. The worker generates a new private key of the requested type.
  2. It builds a fresh CSR with the same CN + SANs.
  3. The CA's normal issuance flow runs (DNS-01 for ACME, CES enrollment for MSCA).
  4. The new cert becomes the current version on the same certificate record. The previous certificate and its private key are retained as a historical version — they are not purged, and remain downloadable per version until history retention prunes them.
  5. A cert.renewed event is written (reissue reuses the renew event type — the distinction surfaces in the event payload's trigger field as reissue).
  6. If the certificate has auto-triggered distributions, they fire against the new cert.
Old cert is NOT revoked automatically

Reissue replaces the cert on our side but the CA still considers the old cert valid until it expires naturally. For key-compromise workflows, follow up with Revoke on the old cert — CertAutoPilot keeps a copy of the old cert's issuance record for this purpose in the timeline.

Pinned clients​

If downstream clients pin the certificate's public key (HPKP, mobile apps with cert-pinning, banking integrations), a reissue breaks them. CertAutoPilot has no way to know this — there is no "pinned" annotation and no warning in the confirm step. Track pinned consumers yourself and plan the client-side update alongside the reissue.

Troubleshooting​

"Rate limit exceeded" on immediate reissue​

The CA's weekly quota for the registered domain is saturated. Wait for the counter to reset — CertAutoPilot does not display CA rate-limit counters, so check your CA's own status page — or use a staging account to avoid production consumption during testing.

MSCA reissue fails with "template has recently been issued to the same subject"​

Some Windows CA templates configured with strict duplicate detection reject same-subject issuance within a window. Adjust the template's re-enrollment policy, or issue against a different template.

See also​