Search... ⌘ K
Get Started Contact Sales

How to Switch From an ECC-Signed Certificate to RSA

Last updated

Table of Contents

DNSimple provides SSL certificates using elliptic curve (ECC) keys by default, but some situations require an RSA key as the certificate signing key. For how the two key types compare, see Understanding SSL Private Keys. Follow the steps below for your certificate type.

Switching a Let’s Encrypt Certificate to RSA

Let’s Encrypt certificates cannot be reissued, so you will need to order a new certificate or manually renew an existing one.

Steps to get an RSA-signed Let’s Encrypt certificate
  1. Disable auto-renewal on the existing ECC certificate you want to replace. Auto-renewal keeps the old key type.
  2. Renew the certificate if it is about to expire, or order a new certificate.
  3. On the order or renewal form, select under .
  4. Click (new certificate) or (renewal).

See our guides for ordering and renewing Let’s Encrypt certificates.

Switching a Sectigo Certificate to RSA

For Sectigo certificates, you can reissue the existing certificate with an RSA key.

Steps to reissue a Sectigo certificate with RSA
  1. Follow the process for reissuing a Sectigo SSL certificate.
  2. In , explain that you need an RSA-based certificate.
  3. Under , choose , or choose to provide your own CSR if you have a custom RSA CSR.
  4. Click .

The Reissue certificate form with a reason filled in and Auto-generate (RSA) selected under Private key

Next Steps

Once the new certificate is issued, you will need to configure, verify, and install it on your server:

Have more questions?

If you have additional questions or need any assistance switching from ECC to RSA, just contact support, and we’ll be happy to help.