A new certificate with the same key

An expired certificate is replaced with a newly issued one, and the site's key usually stays the same.

A certificate has a partner — the private key. The server keeps it to itself: for nginx it is /etc/nginx/tls/secure.key, readable by root only. With the key, the server proves at the start of TLS that the certificate is its own. The public half of the key is written into the certificate.

A new certificate is issued in two steps. First, the server side creates a certificate signing request, a CSR: the public key, subject and SAN, signed with the private key. Then the CA checks the request and issues a certificate from it — with its own issuer, a new validity period and its signature. For secure.lab.test that is two commands; the training CA lives in ~/tls-lab, while in real life its key is kept by whoever issues certificates:

bash

cd ~/tls-lab
sudo openssl req -new -key /etc/nginx/tls/secure.key \
  -subj "/CN=secure.lab.test" \
  -addext "subjectAltName=DNS:secure.lab.test" \
  -out secure.csr
openssl x509 -req -in secure.csr -CA ca.crt -CAkey ca.key \
  -days 90 -copy_extensions copy -out secure-new.crt

-subj sets the subject, -addext the SAN, -days the validity. -copy_extensions copy carries the SAN from the request into the certificate.

nginx starts serving the new file once it rereads its configuration: after replacing the file, run sudo systemctl reload nginx, then s_client or curl again.

Check yourself 1 question

You signed the request without -copy_extensions copy, and openssl x509 -in new.crt -noout -ext subjectAltName prints No extensions in certificate. What will you do?

nginx serves the file as it is. The names are missing from the certificate itself, and a reload will not add them.
The key and the request are fine: the request holds the SAN — openssl req -in x.csr -noout -text shows it. Signing did not carry the names over.
curl matches the name from the address against the SAN. It rejects a certificate without a SAN with no alternative certificate subject name.

The SAN is an extension of the request, and it reaches the certificate only if signing carries it over. The key and the request stay the same; only the certificate needs to be issued again.

Key points

The private key stays on the server; its public half goes into the certificate.
A new certificate is a CSR from the existing key plus a CA signature with a new validity period.
nginx serves a new file after systemctl reload nginx: check what the client sees.

Trust, name and expiry of a certificate

Signing in is needed to start the machine