SSL certificate renewal

Question

I need to update the SSL certificates on two domains hosted on my OS X 10.5.8 server. It appears that renewal cannot happen in Server Admin.
After extensive web reading, I find that under 10.4 you had to use both Server Admin and and Keychain Access to accomplish the renewal. Here is the official Apple instructions:
http://support.apple.com/kb/TA24487?viewlocale=en_US
Is this the same in 10.5?
My problem is that I have only access via SSH to my server and thus cannot run Keychain Access as a GUI. I found that the terminal command 'security' can do much of this, but its man page is highly cryptic and I fear for my certs as I try this. Any help with usage of 'security' to achieve export of a domains certs, deletion, and importation as per the above instructions?
What if using 'Server Admin', I delete the domain certificate before I request and reinstall the new one? This would leave a small hole of uncovered access, but I can live with that. But I don't want to do this to find out that the Keychain Access app is going to throw a fit?
Any help from someone who has done this successfully would be appreciated. Thanks.

Answer 1

To renew your SSL certificate, you can do one of two things:
1) Use your existing CSR to acquire your new certificate.
2) Generate a new CSR to acquire your new certificate.
If you choose to use your existing CSR, you will need to know which keystore file you are currently using and the password you assigned to that keystore file.
Here are the steps to find out which keystore file you are currently using:
1) Login to the PostX Administration Console (GUI)
2) Click on the Configuration tab.
3) Navigate to Web Servers and Proxies > Web Server Config > Connection Listeners > HTTPS (SSL) Connection Listener.
4) You should see a keystore file field. This is will display the path to the keystore file you are currently using.
If you do not remember the password to your current keystore file, we strongly suggest that you create a new CSR.
To generate a new Certificate Request (CSR):
1) Login to the PostX Administration Console (GUI)
2) Click on the Keys and Certificates tab
3) Click on SSL Setup and select Get Certificate Request
4) Fill out the form and hit submit. Your new CSR will be generated in a text box on the page.
5) Copy and paste the CSR onto a local text file which you can then send to your CA of choice.
For more information on the SSL certificate process as well as importing the certificate please refer to our Knowledge Base article 845 at http://tinyurl.com/2n6qru.