<html><head></head><body><div class="ydpc44dcd6dyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div><div dir="ltr" data-setdir="false">I am trying to implement automated domain certificate renewal. A certificate signing request is sent to an ACME server and on success a certificate is returned. I'd like to be able to call OpenSSL to make a new key and then make a new certificate signing request just like the old one except for the replacement key pair file.</div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span>I suppose the complete information beyond the new key data is available both in the old crs and
the old certificate. I'm looking at the
manpages of OpenSSL subcommands 'req' and 'x509'. The openssl x509
option '<span>-x509toreq</span>' gave me a momentary rush of hope, but then I read about the '<span>-signkey</span>' option, which seems to be exclusively about self-signing.</span><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Is 'cloning' the csr or cert. information semantically logical? Is it possible with OpenSSL?<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">If I can't reliably extract the relevant data from the old csr or old certification, I suppose I must do it as usual with a dedicated config file and the '-batch' option:</div><div dir="ltr" data-setdir="false"> openssl req -key <key> -<span>new -config <config.ini> -outform PEM -out <outfile></span> -batch<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Any do's or don't on managing the input data of a signing request for automatic renewal (non-interactive execution)? I'm trying to minimize the file management requirements without losing generality.<br></div><div><br></div><div class="ydpc44dcd6dsignature"><div>Douglas Morris<br></div></div></div></div></body></html>