Expectations for private key rotation when rotating a certificate

[CDR-Register-Stream]

A question has been raised, Can duplicate CSRs be used when reissuing a certificate?

Upon investigation, when a CSR is generated for the same domain (common name), same metadata and using the same private key, an identical CSR is generated. This can be replicated using the following commands:

openssl req -new -newkey rsa:2048 -nodes -out test_com.csr -keyout test_com.key -subj "/C=AU/ST=NSW/L=Sydney/O=CSR/CN=test.com"

openssl req -new -key test_com.key -nodes -out test_com2.csr -subj "/C=AU/ST=NSW/L=Sydney/O=CSR/CN=test.com"

cmp test_com.csr test_com2.csr

If duplicate CSRs are not permissible, then the ACCC is imposing private key rotation requirements on participants as it is tightly coupled to certificate rotation requirements.

Expectations need to be set on:

• How certificate rotation will function
• Are duplicate CSRs permissible within the certificate management processes and if not;
• Where the line is drawn on private key rotation requirements

[CDR-Register-Stream]

Currently duplicate CSRs are not supported. This is not by design but a limitation of the current platform.

Its not our intent to mandate key rotation schedules, but the current constraints means that a new key will be required for certificate reissuance.

Further work is in flight to determine how this constraint may be lifted

[jakubvozarik]

Hi @CDR-Register-Stream

Does this apply for both production and CTS certificates?

Thanks

Currently duplicate CSRs are not supported. This is not by design but a limitation of the current platform.

Its not our intent to mandate rotation schedules, but the current constraints means that a new key will be required for certificate reissuance.

Further work is in flight to determine how this constraint may be lifted

[CDR-Register-Stream]

@jakubvozarik Thanks for your query.
Yes, this applies to all certificate types. The mechanisms used to manage certificates are the same for production and CTS

[CDR-Register-Stream]

Duplicate CSR support is not planned in the short-term but over the longer-term, we will look at the opportunity to lift this constraint.

Participants must ensure they rotate their private keys in conjunction with their certificate rotation and align their processes to this constraint.

We welcome any feedback on this position