A certificate cannot be installed with an unrelated private key. If the matching key is genuinely unavailable, create a new key and request a replacement certificate through the issuer's reissue or rekey process.
01 Establish what happened
- Identify the certificate by hostname, issuer, serial number and order. Check which server or panel generated its CSR.
- Have the authorised administrator inspect the original certificate repository and approved encrypted backups. A certificate downloaded from the order normally contains public information, not the private key created on your server.
- If the key is available and has remained secure, use the supported installation or secure export process. Never paste it into an online diagnostic website.
- If the key is lost, generate a new key and CSR on the intended server, then request reissue for the correct hostnames.
- If the key may have been exposed, treat this as a compromise and contact the issuer promptly for revocation as well as replacement. Investigate every service that reused that key.
- Install the new certificate, verify its serial number on each endpoint, and store recovery material using approved access controls.
Common questions
Can the certificate authority reconstruct my key?
A key generated on your server is not recoverable from the public certificate or CSR. A replacement request is the practical route when no secure copy exists.
Can I keep using a certificate whose key is exposed?
Escalate immediately. Coordinate replacement and revocation with the issuer; do not postpone reporting to maintain the appearance of normal service.
Will a new CSR fix an already downloaded certificate?
The existing certificate remains tied to its original key. The issuer must issue a certificate for the replacement request, and that replacement must be deployed.