The security of an SSL certificate depends on the private key. Anyone who gains possession of the key can impersonate your website until the certificate expires and, in certain cases, may even be able to decrypt the traffic. If the key has been compromised (or you suspect it has), you must act quickly.

When is a key considered to have been compromised?

• Submitted via email, chat or a ticket.
• It has been uploaded to a public or shared location, such as a Git repository, cloud storage or a forum.
• The server on which the key was stored was hacked.
• A former colleague or external developer may have had access, and you are not sure whether they kept a copy.
• The device containing the key (laptop, backup) has been lost.

Steps to follow

1. Create a new private key

Do not use the old key any longer. Generate a new key and CSR on the server where you will be using the certificate; see: Generating a CSR and private key. Do not generate a new CSR from the old key, as this would mean the new certificate would also be linked to the compromised key.

2. Reissue the certificate with the new key

• For paid certificates, go to the certificate page in the client portal and click the ‘Reissue’ button to request a reissue using the new CSR. This is free of charge during the subscription period. See: Setting up and reissuing a paid SSL certificate.
• For free certificates on cPanel hosting, please contact our support team: we will remove the old certificate and AutoSSL will issue a new one with a new key.

• If you are using your own server with a Let’s Encrypt certificate, request a new certificate with a new key:

  certbot certonly --cert-name pelda.hu --force-renewal --new-key -d pelda.hu -d www.pelda.hu
  

3. Install the new certificate

Install the new certificate and key wherever you used the old one: web server, mail server, load balancer, CDN. Delete the old key file from the servers and backups.

4. Revoke the old certificate

Revocation signals to browsers that the old certificate should no longer be trusted.

• For paid certificates, please contact our support team and we will revoke the old certificate with the certificate authority. Please indicate that the key has been compromised.

• For Let’s Encrypt certificates on your own server:

  certbot revoke --cert-path /etc/letsencrypt/live/pelda.hu/cert.pem --reason keycompromise
  

Please only request revocation once the new certificate has been installed; otherwise, the website will continue to display a certificate error until then.

5. Find out how the leak occurred

If the key has been leaked from a compromised server, replacing the certificate is only one of the steps you need to take. Change the passwords for the server and applications, and scan the system. If the key has ended up in a Git repository, simply deleting the file is not enough, as it will remain in previous versions. You should always treat the key as having been leaked.

Why is cancellation alone not enough?

Browsers do not always check revocation lists, so a revoked certificate may remain valid on certain devices until its expiry date. The risk posed by a leaked key is therefore most effectively mitigated by a short validity period. This is one of the reasons why the validity of certificates is becoming increasingly shorter; see: Why are SSL certificates no longer valid for a year?

Prevention

• Create your private key where you intend to use it, and do not move it unnecessarily.
• Never send this to anyone, not even our support team. We will never ask you for it.
• The key file must have strict permissions (chmod 600) and must not be included in the Git repository (add it to the .gitignore file).
• Please use a new key for every reissue.
• Where possible, use automatic renewal: on cPanel hosting, the AutoSSL or Autoinstall feature for paid certificates generates and installs the key without the need for manual intervention.