Can you generate a private key for an existing certificate?

No. An existing certificate contains a public key, and you cannot feasibly reconstruct its corresponding private key from it. Generating a new key creates a different pair; that key will not work with the old certificate.

Locate the original private key, including any managed-key provider, or generate a new pair and obtain a new certificate. A CA signs the certificate with the CA's signing key; it does not create your missing server key from the certificate.

Look for the original key

Check the server configuration first: SSLCertificateKeyFile may already identify the expected path. Common file locations include:

ls /etc/ssl/private/
ls /etc/letsencrypt/live/*/privkey.pem
ls /etc/pki/tls/private/

Also check the machine where the CSR was generated, controlled backups, and the secret-management system used for deployment. If a targeted search is needed:

sudo find /etc /opt -type f \( -name '*.key' -o -name 'privkey.pem' \) -print 2>/dev/null

Adjust the directories to your deployment. A filename is only a clue: it does not prove that a file is the correct key. A key held in an HSM may never exist as an exportable file.

Check whether a candidate matches

Compare the certificate's and key's public keys in a common encoding. Run each command successfully before comparing the digests:

openssl x509 -in cert.crt -pubkey -noout -out cert-public.pem
openssl pkey -in candidate.key -pubout -out key-public.pem
openssl pkey -pubin -in cert-public.pem -outform DER -out cert-public.der
openssl pkey -pubin -in key-public.pem -outform DER -out key-public.der
openssl dgst -sha256 cert-public.der key-public.der

This works for common RSA and EC keys. Matching hashes after successful commands confirm key pairing, not certificate trust or hostname coverage. See OpenSSL pkey.

If the key is lost, reissue

Create a new private key and CSR, including the required SAN names:

umask 077
openssl req -new -newkey rsa:2048 -noenc \
  -keyout server.key -out server.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com"

This example targets OpenSSL 3.x; older versions use -nodes in place of -noenc. Submit the CSR to your CA and retain the private key. For an Apache installation managed by Certbot with the Apache plugin installed, the corresponding issuance flow can be:

sudo certbot --apache -d example.com

Issuing a replacement does not automatically revoke the old certificate in every CA workflow. If the old key may have been exposed, request revocation according to the issuer's process.

Configure Apache

SSLEngine on
SSLCertificateFile    /etc/ssl/certs/server-fullchain.pem
SSLCertificateKeyFile /etc/ssl/private/server.key

For supported Apache versions, the certificate file can contain the leaf followed by intermediates. Validate the configuration before reloading, and inspect the certificate returned by a fresh client connection.

Store encrypted backups or managed secrets with restricted access. A file key commonly uses mode 600, owned by the identity that must load it; do not assume every service runs as root.

Common questions

Can a .pfx or .p12 archive recover the key?

Possibly. PKCS#12 can contain private keys and certificates, but not every archive includes a key. Inspect the archive securely and, if present, extract the key to a protected file:

umask 077
openssl pkcs12 -in cert.pfx -nocerts -out recovered-key.pem

This normally encrypts the exported private key and prompts for passwords. Do not dump an unencrypted key to the terminal.

Will HTTPS be interrupted during reissuance?

If the service still has a working key and certificate loaded, you may be able to prepare the replacement before reloading. If the required key is already unavailable and the service cannot start, reissuance cannot guarantee uninterrupted service. Prepare, validate, and deploy the pair together.

See OpenSSL req and Apache mod_ssl.