As client and server certificates are getting issued, it can happen that their validity has expired, or perhaps the user wants to replace the private key.

At the moment this can be done by removing the artefacts, and issuing the certificate again. However, the problem with this is that:

• It is not possible to preserve the private key and just get a new certificate.
• It is required to provide the very same information provided the last time, which is tedious.

It would be good if there was a built-in convenient way to do this instead.

The following should be done:

• Implement a renew certificate command.
• Renew command should:
  • Optionally generate a new private key.
  • Use the same naming as in the original certificate.
  • Replace the existing certificate with a new one.
  • Provide user with information on what has been done.
• Renew command should accept the following positional arguments:
  • Type of entity (server/client).
  • Name of entity.
• Renew command should accept the following optional arguments:
  • Flag denoting that the private key should be regenerated.
• Renew command should be implemented with the following constraints in mind:
  • Command should not run in case the entity is not known. Instead an informative error message should be shown.
  • Existing artefacts should be replaced with new ones. It should be possible to do this as late as possible, once both private key and certificate are known, in order to avoid partial writes.
  • In case of any additional naming (like DNS subject alternative names), information should be pulled-out of the existing certificate.
  • New certificate should contain same set of extensions as the original one (basic constraints, KU, EKU, subject alternative name).
  • Certificate should be issued by the leaf CA (furthest away from the root/level 1 CA).
  • Certificate validity should not exceed the CA validity.
  • Validity should start at time of issuance minus 15 minutes.
  • Both server and client certificate renewal should be supported.
  • Example usage in help should be updated for the new command.

Documentation should cover:

• Command usage for both server and client.
• Command usage should cover cases where private key is kept and where private key is regenerated as well.
• Information about subject DN and subject alternative names being take from existing certificate.