To ensure there is no confusion about this: replacing your digital certificate is a process where your previous certificate (within the same account with us) is revoked, new keys are generated, and a new certificate is created.

This process is normally only needed if your current certificate keys are currently unusable for some reason (deleted, forgotten private key password, etc).

A 'Certificate Replacement' is only able to be done with accounts where we do not have a copy of an encryption certificate private key. (please note, that we NEVER have a copy of your signing-certificate private key). Example types: TrustID, ACES, DOD IECA, SWA Standard-Assurance browser, SWA High/Intermediate Signing-Only.

For accounts where we do escrow (save a copy of) the encryption private key, a 'Certificate Replacement' is not an option. A ' Key Recovery' needs to be done instead.

To replace a digital certificate:

1. Log into our online Certificate Management Center:
• If it asks you to choose a certificate to log in with, click 'Cancel'.
• Enter in your account number, and DST Passphrase. (the passphrase you entered when first applying for the certificate)
2. Look for the drop-down box under the listing for your "Valid Certificates". Select "I would like to replace my certificate", and click the 'Continue' button.
3. Select to "Generate a Replacement Certificate", and click 'Next'.
4. Follow the onscreen instructions to retrieve the new certificate. Note: it will give you a new activation code to use during the retrieval. You should write that down.
5. At the end of the retrieval, it will tell you to "Verify" the installation. Be aware that if using Internet Explorer, this will fail the first time (because you had to click 'Cancel' on step #1), but it will give instructions to follow to successfully verify it.