I lost my private key — what now?

Updated on 09 Sep 2026

The private key is generated on your server alongside the CSR, never leaves it, and cannot be recovered. Neither we nor the certificate authority hold a copy: if we did, it would not be private.

Without it, the certificate you received is useless. It is one half of a pair, and without the other half it encrypts nothing.

The good news: the fix is free. The certificate is reissued against a new key, inside the same order.

Before you give it up for lost

Look for it first. It is usually where you left it:

  • Apache, nginx, LiteSpeed — at the path you gave when generating the CSR, with a .key extension. Try /etc/ssl/, /etc/pki/tls/private/, or the directory you ran the command from.
  • cPanel, WHM and Plesk — keep the key in the SSL/TLS manager if you generated the CSR there. Look under "Private Keys".
  • IIS and Exchange — Windows does not show you the key as a file, but it keeps it. As long as the server is the same one and you have not deleted the pending request, it is still there.
  • Tomcat — it is inside the .jks keystore, next to the certificate.

If you have a .key file and are not sure it is the right one, check with our certificate and key matcher: paste both and it tells you whether they are a pair.

If it really is gone

Reissue. It is free, unlimited, and it stays the same order:

  1. Generate a new CSR on the server the certificate will live on. That creates a new private key too.
  2. Reissue from your dashboard by pasting that CSR.
  3. Install the new certificate when it arrives.

The detail is in how to reissue your certificate.

When this is more urgent

Losing the key is an inconvenience. Leaking it is something else. If your private key has been exposed — in a public repository, on a compromised server, in an email — anyone can impersonate your site until that certificate expires.

Reissue as above, but also tell us so we can request revocation of the old one. Reissuing does not switch off the old certificate: it stays valid until its own date.

How not to lose it again

  • Keep it with the certificate, wherever you keep your server credentials.
  • Do not send it by email or chat. If somebody asks you for it that way, be suspicious.
  • When moving servers, take it with you — or simply reissue on the new server, which is usually cleaner than copying keys around.