[pkix] RFC 2986 Guidance

[daniel bryan <[e-mail]>]

Hello, I was reading RFC 2986 hoping to find guidance on an issue I
encountered and it's unclear to me if this issue is covered in the RFC. I
was hoping you all could share your thoughts on my situation defined below.

*Situation:* We use a web application that generates a CSR for an SSL
Certificate based solely off an inputted DN value. For example, we input
the value of C=US/O=GROUP/OU=Servers/CN=webappssl, and the web application
generated a CSR. We submitted the CSR to a Certificate Authority and it
signed the CSR based on the certificate template defaults for an
SSL cert.  Time passes, and our SSL cert expires. We intend to renew/obtain
a new SSL certificate for our webapp. We use the original DN mentioned
above, and it generates a CSR again.  We submit the CSR to our Certificate
Authority provider and the CA rejects the CSR saying that it has already
signed this CSR.

*Resolution: *I am attempting to figure out if I need to ask the vendor to
support unique CSR's even when the DN remains the same, or if I need to
contact the Certificate Authority team to ask them why they are blocking
duplicate CSRs. I would like to backup my request with definitive guidance
from an RFC.

*Question:* My question is, does RFC 2986
<https://tools.ietf.org/html/rfc2986>  or any other RFC provide guidance on
the situation above? I didn't notice anything during my initial scan, but I
wanted to check with you all.

Thanks,

--Dan