Renew Self-Signed Certificate from an Existing Private Key and CSR

Question

I have this files generated for a Postgres instance

-rw-r--r--  1 root root 2733 Jun  8 20:37 server-cert.pem
-rw-r--r--  1 root root 3322 Jun  8 20:37 server.csr
-rw-------  1 root root 1704 Jun  8 20:37 server-key.pem

The certificate has expired, i need to renew theme possibly using same private key and CSR

I can't get it working, anyone che help? thanks

UPDATE seems there are some error, i need to update ca certificate too

-rw-r--r--  1 root root 2895 Jun  8 20:37 ca-cert.pem
-rw-r--r--  1 root root   41 Jun  8 20:37 ca-cert.srl
-rw-r--r--  1 root root 3350 Jun  8 20:37 ca.csr
-rw-------  1 root root 1704 Jun  8 20:37 ca-key.pem
-rw-r--r--  1 root root 2733 Jun  8 20:37 client-cert.pem
-rw-r--r--  1 root root 3322 Jun  8 20:37 client.csr
-rw-------  1 root root 1704 Jun  8 20:37 client-key.pem
-rw-r--r--  1 root root 2733 Jun  8 20:37 server-cert.pem
-rw-r--r--  1 root root 3322 Jun  8 20:37 server.csr
-rw-------  1 root root 1704 Jun  8 20:37 server-key.pem
root@SQLECOFIL1:~/cert_bkp# openssl x509 -CA server-cert.pem -CAkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem
Getting CA Private Key
/CN=pg-server
error with certificate - error 20 at depth 0
unable to get local issuer certificate
/CN=pg-server
error with certificate - error 21 at depth 0
unable to verify the first certificate

* UPDATE 2 *

-rw-r--r-- 1 postgres postgres  993 Jun 10 20:52 new-server-cert.pem
-rw-r--r-- 1 postgres postgres 2733 Jun  8 18:36 server-cert.pem
-rw------- 1 postgres postgres 1704 Jun  8 18:36 server-key.pem
root@SQLECOFIL1:/etc/ssl/postgresql# openssl x509 -signkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem
Getting Private key

The file new-server-cert.pem has been verified but can't connect to Postgres server (verification failed)

Answer 1

If your current (or expired in your case) certificate has restrictive Key Usage, you cannot use it as a CA to sign a new certificate. Instead, you can use the private key and original certificate to create a new self-signed certificate:

openssl x509 -signkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem

If your has the certSign Key Usage (or no Key Usage) you can also use the following to sign using the certificate and key:

openssl x509 -CA server-cert.pem -CAkey server-key.pem -set_serial 256 -days 365 -in server-cert.pem -out new-server-cert.pem

In both examples:

The -days 365 sets the validity period of the new certificate (365 days in this case).

The -set_serial 256 sets the new serial number (to 256 in this case)

An alternative to setting the serial yourself is to use -CAcreateserial instead of -set_serial <n> to have OpenSSL create a random serial number for you.

You can adjust these as necessary, but you must use them otherwise you'll end up with a certificate with no serial number and/or a validity of 0 seconds.