Reissuing and revoking a certificate

You need a reissue when you need a new key: the key leaked, the server moved or you lost the key file. You need revocation when the certificate can no longer be trusted.

Who can do what in the certificate card: all roles of the organization can download files; owners, administrators and technicians can reissue; owners and administrators can revoke.

Scheduled renewals

You do not pay for them. The 1-year subscription runs in parts, and we issue each new part ourselves. It uses the same key, so all that is needed is for your server to pick up the new certificate: automatic renewal.

Reissue with a new CSR

The term and the money stay the same, and the domain is confirmed again. The previous version stays valid until you revoke it.

1. Create a new key and CSR: on the server or in the cabinet (Ordering and activation). The CSR must be for the same domain and the same names.
2. Open the certificate card: cabinet. Go to the “Key and CSR” tab.
3. In the block “Reissue with a new CSR” paste the CSR and choose the domain validation method.
4. Click “Reissue”. The cabinet may ask you to confirm your sign-in again.
5. Confirm the domain (Domain validation). The new version appears in the “Versions” list.
6. Install the new files on the server and then, if the old key is compromised, revoke the previous version.

We email the organization owners about a reissue. The set of names does not change during a reissue: if you need other names, order a new certificate.

Revocation

Revocation cannot be undone: browsers will stop trusting this version. Revoke if the key leaked or the certificate is no longer needed.

1. In the card open the “Revocation” tab.
2. Choose the version and the reason.
3. Type the domain name to confirm and click “Revoke”.

If the key leaked, first reissue the certificate with a new key, install it on the server and only then revoke the old version. Otherwise the site is left without a valid certificate for a while. The owners get an email about the revocation.

Refunds

Money is fully returned only until the certificate is issued: if the authority refuses or the domain is not confirmed within 25 days, we return the amount to the balance ourselves. After issuance there is no refund.

If it didn't work

• “Your role doesn’t allow this”. Ask an owner or administrator of the organization.
• “The CSR was made not for …”. The names in the new CSR must match the names of the certificate.
• “This is a private key, not a CSR”. Paste the request text, not the key.
• The reissue failed. The reason is in the card log (“What happened”). Try again or write to support.
• “Too many orders”. There is an hourly limit, try later.
• No valid versions. There is nothing to revoke: the certificate is not issued or already revoked.