> Shouldn't it be impossible to generate a new cert (with a different expiry date) that ends up having the same public key as an existing cert? If you have the

> Shouldn't it be impossible to generate a new cert (with a different expiry date) that ends up having the same public key as an existing cert? If you have the secret key of the original certificate, you can use the same key material, and just use different meta data (like expiry date).