webzod
account

Re-issue the certificate with a stronger key

tls.cert.weak_key · effort: minutes

Why it matters

The certificate's key is too short or uses an outdated algorithm, which weakens or breaks the encryption it protects. Browsers and CAs no longer accept such keys.

The fix

  1. Generate a new private key. Use ECDSA P-256, or RSA with at least 2048 bits (3072 if you prefer a larger margin). Never reuse the weak key.
  2. Request a new certificate for that key from your CA, install it and reload the web server.
  3. With certbot you can switch an existing certificate to an ECDSA key in one command.
  4. Delete the old key files once the new certificate works, and revoke the old certificate if the key may have leaked.
bash 
sudo certbot certificates    # shows the certificate name to use below
sudo certbot renew --key-type ecdsa --cert-name <name> --force-renewal
sudo systemctl reload nginx    # or apache2 / httpd

# for a purchased certificate, create a key and a request to send to the CA
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out example.com.key
openssl req -new -key example.com.key -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com" -out example.com.csr

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.