2

I have this files generated for a Postgres instance

-rw-r--r--  1 root root 2733 Jun  8 20:37 server-cert.pem
-rw-r--r--  1 root root 3322 Jun  8 20:37 server.csr
-rw-------  1 root root 1704 Jun  8 20:37 server-key.pem

The certificate has expired, i need to renew theme possibly using same private key and CSR

I can't get it working, anyone che help? thanks

UPDATE seems there are some error, i need to update ca certificate too

-rw-r--r--  1 root root 2895 Jun  8 20:37 ca-cert.pem
-rw-r--r--  1 root root   41 Jun  8 20:37 ca-cert.srl
-rw-r--r--  1 root root 3350 Jun  8 20:37 ca.csr
-rw-------  1 root root 1704 Jun  8 20:37 ca-key.pem
-rw-r--r--  1 root root 2733 Jun  8 20:37 client-cert.pem
-rw-r--r--  1 root root 3322 Jun  8 20:37 client.csr
-rw-------  1 root root 1704 Jun  8 20:37 client-key.pem
-rw-r--r--  1 root root 2733 Jun  8 20:37 server-cert.pem
-rw-r--r--  1 root root 3322 Jun  8 20:37 server.csr
-rw-------  1 root root 1704 Jun  8 20:37 server-key.pem
root@SQLECOFIL1:~/cert_bkp# openssl x509 -CA server-cert.pem -CAkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem
Getting CA Private Key
/CN=pg-server
error with certificate - error 20 at depth 0
unable to get local issuer certificate
/CN=pg-server
error with certificate - error 21 at depth 0
unable to verify the first certificate

* UPDATE 2 *

-rw-r--r-- 1 postgres postgres  993 Jun 10 20:52 new-server-cert.pem
-rw-r--r-- 1 postgres postgres 2733 Jun  8 18:36 server-cert.pem
-rw------- 1 postgres postgres 1704 Jun  8 18:36 server-key.pem
root@SQLECOFIL1:/etc/ssl/postgresql# openssl x509 -signkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem
Getting Private key

The file new-server-cert.pem has been verified but can't connect to Postgres server (verification failed)

3

If your current (or expired in your case) certificate has restrictive Key Usage, you cannot use it as a CA to sign a new certificate. Instead, you can use the private key and original certificate to create a new self-signed certificate:

openssl x509 -signkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem

If your has the certSign Key Usage (or no Key Usage) you can also use the following to sign using the certificate and key:

openssl x509 -CA server-cert.pem -CAkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem

In both examples:

The -days 365 sets the validity period of the new certificate (365 days in this case).

The -set_serial 256 sets the new serial number (to 256 in this case)

An alternative to setting the serial yourself is to use -CAcreateserial instead of -set_serial <n> to have OpenSSL create a random serial number for you.

You can adjust these as necessary, but you must use them otherwise you'll end up with a certificate with no serial number and/or a validity of 0 seconds.

4
  • thanks. but seems there is an error – Augusto Murri Jun 9 '20 at 8:17
  • @AugustoMurri - that's because your certificate has a restrictive KeyUsage extension which prohibits it being used as a CA certificate (and rightly so). The alternative method in my answer doesn't care about KeyUsage. – garethTheRed Jun 9 '20 at 12:46
  • tried with both command but nothing :/ – Augusto Murri Jun 10 '20 at 19:17
  • 1
    As it's a self-signed certificate, it needs to be at both ends of the connection - on the client end and on the server. Have you done that? If the command has created the certificate and the fields and extensions are correct, then the certificate has successfully renewed - openssl x509 -noout -text -in new-server-cert.pem will show you the contents. Further problems should be in a new question. – garethTheRed Jun 10 '20 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.