Generate a new CSR from existing CRT and KEY

$ openssl x509 \
       -in domain.crt \
       -signkey domain.key \
       -x509toreq -out domain.csr