DEV Community

Cover image for Lost Your Private Key for Your SSL Certificate? Here is How to Fix It in 10 Minutes
Muhammad Aqib Bin Azam
Muhammad Aqib Bin Azam

Posted on

Lost Your Private Key for Your SSL Certificate? Here is How to Fix It in 10 Minutes

#ssl #openssl #security #devops

πŸ”₯ The Situation

You bought an SSL certificate. You downloaded the .crt file. You are ready to install it.

Then you hit the wall.

"Where is the private key?"

You check the zip file. No key.
You check the CA portal. No download button.
You check your emails. Nothing.

Panic starts to creep in.

Here is the truth: Your Certificate Authority (CA) never had your private key. And they never will.

But do not worry. You do not need to buy a new certificate. You do not need to call support. You just need 10 minutes and this guide.

🧠 The Mindset Shift

Here is what most people get wrong:

What you think What is actually true
The CA gives me the private key The CA only gives the public certificate
I can download the key from the portal The key is generated on YOUR server
I lost the key = I buy a new cert You can REKEY the existing cert

The private key is like the key to your house. The CA is just the locksmith who certifies that the lock works. The locksmith never keeps a copy of your key.

Once you understand this, the fix is simple.

πŸ› οΈ What You Need

  • Access to your CA account (where you bought the SSL)
  • OpenSSL (5 seconds to check: run openssl version in your terminal)
  • 10 minutes

πŸ“‹ The Fix in 4 Steps

Step 1: Generate a New Key and CSR on Your Machine

Open your terminal and run these two commands:

openssl genrsa -out yourdomain.key 2048
Enter fullscreen mode Exit fullscreen mode 
openssl req -new -key yourdomain.key -out yourdomain.csr
Enter fullscreen mode Exit fullscreen mode

The second command will ask you a few questions. Here is the cheat sheet:

Question Your answer
Common Name (CN) yourdomain.com (exact domain)
Country US (or your 2-letter code)
State Your state
City Your city
Organization Your company name
Everything else Just press Enter

Boom. You now have:

  • yourdomain.key β†’ Your brand new private key (GUARD THIS WITH YOUR LIFE)
  • yourdomain.csr β†’ The request you will send to your CA

Step 2: Copy Your CSR

Run this:

cat yourdomain.csr
Enter fullscreen mode Exit fullscreen mode

Copy everything from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST-----.

Step 3: Rekey Your Certificate with Your CA

Log into your CA account.

Look for one of these buttons:

  • "Rekey" (GoDaddy)
  • "Reissue" (DigiCert, Comodo)
  • "Regenerate" (Others)

Paste your CSR into the box. Submit.

Wait 5–10 minutes. Check your email. Your new certificate is ready.

Step 4: Download and Combine

Download the new certificate files from your CA. You will get something like:

  • yourdomain.crt (your certificate)
  • ca_bundle.crt or intermediate.crt (the chain)

Now run the magic command:

openssl pkcs12 -export -out yourdomain.pfx -inkey yourdomain.key -in yourdomain.crt -certfile ca_bundle.crt
Enter fullscreen mode Exit fullscreen mode

It will ask for a password. Set one. Remember it.

Done. You now have your PFX file with your private key inside.

πŸ§ͺ Verify It Worked

Run this:

openssl pkcs12 -info -in yourdomain.pfx -noout
Enter fullscreen mode Exit fullscreen mode

Enter your password. If you see certificate details without errors, you are golden.

❓ But What If...

"I have a .p7b file instead of a bundle?"

Convert it first:

openssl pkcs7 -in yourdomain.p7b -print_certs -out bundle.crt
Enter fullscreen mode Exit fullscreen mode

Then use bundle.crt as your -certfile.

"I have multiple domains (UCC/SAN certificate)?"

When you rekey in your CA portal, look for a section called "Subject Alternative Names" or "SANs". Add all your domains there:

  • yourdomain.com
  • api.yourdomain.com
  • portal.yourdomain.com

"My CA rejected my CSR?"

Make sure your Common Name (CN) exactly matches your domain. No www. unless that is the exact domain you want.

"I lost the private key I just generated?"

You cannot recover it. Just run Step 1 again and rekey one more time.

🚫 What NOT to Do

❌ Don't βœ… Do
Buy a new certificate Rekey your existing one
Ask your CA for the private key Generate your own key pair
Ignore the bundle file Include it in your PFX
Share your .key file with anyone Keep it secret, keep it safe

πŸ“¦ Files Cheat Sheet

File What it is Can you share it?
yourdomain.key Your private key πŸ”΄ NEVER
yourdomain.csr The request you send to CA 🟒 Yes
yourdomain.crt Your public certificate 🟒 Yes
ca_bundle.crt Intermediate certificates 🟒 Yes
yourdomain.pfx Key + cert combined 🟑 Only if password protected

🎯 The Bottom Line

You did not lose your private key.

You never had it from your CA.

And that is actually a good thing for security.

The fix is simple:

  1. Generate a new key + CSR
  2. Rekey your certificate with your CA
  3. Download the new cert
  4. Combine into a PFX

Total time: 10 minutes.

πŸ’¬ The Last Word

Every developer hits this wall at least once. The first time, it feels like a disaster. The second time, it is a 10-minute task.

Now you know.

Save this guide. Share it with your team. And the next time someone says "I lost my private key", you can send them here and look like a hero.

Did this save your day? Drop a comment. ❀️

Top comments (0)