The problem

Monitoring warns that the certificate of shop.example.org expires on 5 November 2026. Before you renew it, you check what the current certificate says, whether the server sends it, and whether the key on disk belongs to it. Every rep uses OpenSSL 3.0.

In the current directory: shop.crt is the current certificate (subject O = Shop, CN = shop.example.org, SANs shop.example.org and www.shop.example.org), shop.key is its private key, and new.key is a fresh key for the renewal. A test instance of the site listens on localhost:8443 and serves shop.crt for the name shop.example.org.