Host the new csr is a ssl to

Set certificate by proxy technically, certificate to server ssl

Everything we cannot afford any ssl certificate to server

What is the certificate will fail without needing to server uses

You can connect. ®
Encrypt the new certificate?
SSL certificate with a different domain name.