可以在没有CSR且使用旧私钥的情况下颁发证书

Question

I'm confused about something in the SSL renewal process using WHM/cPanel for an existing Comodo Extended Validation cert.

We have been issued a replacement certificate by Comodo without - I believe - every submitting a CSR for them. I say "I believe" because there are 3 people with access to WHM for this server, but I'm assured that no one has been fiddling in the last year.

Does this sound possible? CAN a cert be supplied without a CSR if it's a replacement? I will attempt to get hold of Comodo but being a weekend, and seeing that the old cert runs out in a day I thought I'd consult the stackHiveMind :)

More info: As a test, I've tried to install the new cert and 'fetch' the existing private key, but when I try to submit that I get the following error: SSL install aborted due to error: Modulus mismatch, key file does not match certificate. Please use the correct key file

Answer 1

In some cases, yes, you can. Assuming you have an RSA private key in PEM format, this will extract the public key (it won't generate a certificate):

openssl rsa -in key.pem -pubout -out pubkey.pem

This will create a new CSR with the public key, obtained from the private key file.

openssl req -new -key key.pem -out host.csr

Note that, strictly speaking, a CA doesn't need you to submit a CSR to issue a certificate. All it needs is the public key (to which it will have access through your existing cert). It could potentially attach any Subject DN and attribute and issue it as a certificate without any need to contact you. Of course such practices might be incompatible with their policies, but technically, it's possible. The CSR is merely a convenient format for you to send a public key to request a certificate, and submit the name and attributes you would like (which you all sign together).

SSL install aborted due to error: Modulus mismatch, key file does not match certificate. Please use the correct key file

Provided you've done the certificate operations properly, this could indicate that the new certificate you've been issued has been issued against a different key-pair than yours. This could indicate foul play, because someone else could have issued a CSR with their own key-pair and have had this certificate issued to them (which could be quite worrying since you're talking of an EV cert too, which is supposed to have additional protections against this.)

I would suggest checking with your colleagues if any have requested a new certificate or contacting your CA to find out why you've received a new certificate. Renewing the certificate using the previous public key might be part of their existing package. If it's using the same public key, it's not a problem, although it's better practice to change the key material, ie submit a CSR coming from a new key-pair, when renewing a certificate.