Recovery Material Is Valuable Material
A certificate may still be valid when its application configuration changes or its server is replaced. Repeating CA issuance is not always the right response. SSLNexus 1.0.11 keeps issued certificate material locally so a suitable, valid certificate can be deployed again.
Reissue certificate preserves the existing key, serial number and expiry date. It bypasses the CA and does not consume issuance limits or incur a new issuance charge. It does not extend validity or change the certificate’s approved names.
Encryption Remains Your Choice
The optional local keystore encrypts managed certificate private-key artifacts, saved PFX material and pending issuance records within the configured artifact root. Existing plaintext is not automatically migrated during installation or an ordinary restart.
Enabling storage encryption is a deliberate administrator choice. Public certificates and CSRs remain readable, while other credentials, deployed target keys and backup archives keep their separate protection requirements.
Automatic Unlock Keeps Renewal Unattended
A protected local unlock key lets the service use its encrypted records after restart without a passphrase prompt. That preserves unattended renewal.
The protection boundary matters: an artifact copy without its unlock key is different from a complete server or backup containing both. This feature does not protect a compromised running host and does not introduce HSM/KMS or non-exportable-key custody.
Migrate With A Recoverable Backup
Before enabling encryption, make a protected backup and stop SSLNexus and any other process that writes certificate material. Follow the offline migration procedure, inspect its status and restart only after completion without errors. An interrupted migration can be resumed while writers remain stopped.
Migration does not rewrite historical backups or erase copies retained in snapshots. Review those copies under your own retention and backup-protection policy.
Back Up The Matching Key And Data
Keep the original unlock key with the matching encrypted material, database and configuration in protected recovery storage. A newly generated key cannot decrypt records protected by a lost key.
After restoring a migrated installation, verify storage access before reissuing to replacement targets. Reissue stops if suitable retained material is missing or expired; it does not silently place a new CA order.
Exports And Deployments Still Need Protection
Supported PEM/PFX exports and application deployments need usable key material. Protect those outputs, their transport and the receiving application separately. Encrypting the retained store does not change the destination’s key-generation model.
For a shared Nginx or Apache server, select the correct recorded adapter and site. Reissue does not install or start a competing web server, and a failed configuration check prevents reload.
A Practical Checklist
- Identify the retained certificate material needed for recovery.
- Choose whether local storage encryption fits your protection requirements.
- Back up and test restoration of the matching key, data and configuration.
- Complete offline migration before resuming automation.
- Protect exported and destination copies independently.
- Use Reissue for a suitable existing certificate; use Request new certificate for fresh CA issuance.