What is the difference between renewing a certificate and rekeying it?

Short answer

Renew is the re-signing of a certificate with the same key and subject information for a new validity period; since the public key does not change, configurations bound to the key (e.g. key pinning) are not affected. Rekey, on the other hand, is the generation of a new private key and the re-creation of the certificate with this key; it is done when the key is suspected of having been compromised or when the key algorithm or length is to be changed. In TR7, Upload a re-signed certificate and Re-issue on the CSR are renewals that keep the same key; Renew Now (internal CA) regenerates the certificate with a new key. For CAs, Renew Certificate keeps the key, and Change Key gives the CA a new key.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → SSL/TLS Certificates → right-click	Upload a re-signed certificate	Renew: the certificate that the CA has re-signed for the same key is matched with the key in the record and put in place
SSL/TLS Certificates → CSR (External CA) → right-click	Re-issue: upload a newly signed certificate	Renew: the same CSR is signed again by the CA; the key and the record do not change
SSL/TLS Certificates → right-click	Take the key into the library	Moving the key of the certificate into the Private Key Library; subsequent CSRs can use the same key
SSL/TLS Certificates → right-click (record issued with an internal CA)	Renew Now (internal CA)	Rekey: the certificate is regenerated with a new key and a new serial number; the record and the vService assignments are preserved. Automatic renewal bound to the profile also generates a new key
Certificates & PKI → Certificate Authorities (CA) → right-click	Renew Certificate	Renew: keeping the key and the subject of the CA, renews only its own validity period; does not touch the certificates and sub-CAs under it
Certificate Authorities (CA) → right-click	Change Key	Rekey: gives the CA a new key; the certificates issued by an issuing CA are regenerated immediately, and the sub-CAs of a root CA are re-signed with their own keys preserved

Renew Certificate and Change Key can be used only on internal CAs generated on TR7.

Comparison

	Renew	Rekey
Private key	Same	New
Public Key Fingerprint	Does not change	Changes
Validity period	New	New
On a CA: the signatures under it	Remain valid	Become invalid; are re-signed
When	Routine renewal before the period expires	When the key is compromised or the algorithm/length is to change

Common Misconceptions

• "Renewing a CA regenerates the certificates under it." Renew Certificate does not touch the certificates under it; regeneration happens with Change Key.
• "Renew Now (internal CA) keeps the same key." It regenerates the certificate with a new key and a new serial number; the ID of the record and the vService assignments do not change.
• "When the key of the root CA changes, the clients do not have to do anything." The new root certificate must be distributed to the clients that keep the old root in their trust store.

How it is done in the documentation

• SSL/TLS Certificates · Right-Click Menu
• SSL/TLS Certificates · Uploading a Re-signed Certificate
• Certificate Authorities (CA) · Right-Click Menu

Related questions

• When I renew a certificate, do I need to replace it on each vService one by one?
• Can I manage Private Keys separately (Private Key Library)?
• Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?
• What is a certificate fingerprint?