Certificate reissue reasons explained
A certificate reissue creates a new SSL/TLS certificate under an eligible existing service order. You may need one if the private key is lost or compromised, the CSR is wrong, the certificate's covered names must change, or the issued certificate can no longer be deployed correctly.
Which situations call for a reissue?
Reissue is not the same as renewing the service
A paid multi-year SSL service term (if offered) is not one certificate valid for multiple years. Under the CA/Browser Forum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled for later years.
Reissuing does not necessarily extend the service's paid term. The renewal date of the service order and the expiry date of the installed certificate must be monitored separately.
What to prepare before requesting a reissue
Identify the exact SSL order, hostnames, validation level (DV/OV/EV), server or CDN environment and reason for replacement. If the old key is compromised, generate a fresh key and CSR and follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.
For the actual step-by-step request and installation, see How do I reissue my SSL certificate.
After deployment, verify the certificate SAN, validity, trust chain and the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges or load balancers.
Reissue versus renew versus revoke
Example 1 — compromised web-server key. If an attacker may have obtained example.com's TLS private key, generate a new key and CSR, obtain a replacement certificate, coordinate revocation of the exposed certificate and deploy the new one everywhere. Reinstalling the old certificate would not resolve key compromise.
Example 2 — moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate and private key remain usable in the approved configuration. Check who terminates TLS and whether a new key is required.
Example 3 — adding shop.example.com. If the current certificate covers only example.com, issuing a replacement with the appropriate SAN set or obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.
