Can I re-download a cert from the ca?

[logopk]

Hi,

if I have messed up my setup and lost the cert (not the key) could I request the same cert again?
I know I could reissue a cert but for my usecase I'd prefer longer living client certs. And therefore need revocation with CRL and OCSP.

Thanks Peter

I have a stupid old script that overwrote all client certs with the old expired from my old ca :-( .

[maraino]

There are different options, the most obvious one is to create a new one using a CSR with the same key:

step certificate create --csr --key my.key --san foo.bar "My certificate" my.csr
step ca sign my.csr my.crt

But If you want to retrieve the same one, you can try to retrieve it from the logs or from the database. But this can be quite tricky as you might need to create a custom program to read the db.

[logopk]

OK understood, that may be a hassle. So I will revoke all certs and start new with the CSR and Key.

[logopk]

However I already have an exporter to write the index.txt for the CRL and OCSP-Responder. That may be a nice project for the next weekend...