Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can't seem to find the answer for this through google, so hopefully someone here can help me out.

I have a wildcard certificate that is about to expire in 9 days. I received a new certificate from the CA that will expire in 2012. I installed the certificate in the personal certificate store. So I now have both certificates in there.

I created a new test website with the same ip address as the other sites, but gave it a different host header. I applied the new 2012 certificate to this site. So far so good.

If I go to the site in IE, click the lock icon, click on view certificate, it shows the 2010 certificate.

If I delete the 2010 certificate, the site stops working, even though the server still shows that the site has the 2012 certificate installed.

I have been working on this for days and can't seem to figure this out.

Has anybody else had this problem before? Any ideas on how to fix this?

share|improve this question
Is this IIS6 or 7 and what Server OS is this? It could be as simple as opening the properties of your website and importing the new certificate file. – JamesK Aug 19 '10 at 12:58
It's IIS 6 and it's windows Server 2003 R2 Enterprise Edition SP2 – sbaxter Aug 19 '10 at 13:02
Unless you have any errors from the logs to post, maybe a good start is to detail the process you used to install the new certificate? Hopefully there's just an 'i' not dotted somehwere... – Kara Marfia Aug 19 '10 at 13:06
Unfortunately, I don't have the ability to post the log. I'm not sure how I can get anymore detailed than I have already posted. After creating the new site, I went to properties, Directory Security, Server Certificate and went through the wizard. I think the main issue I'm having which I forgot to mention in my post is I'm going from a 1024bit cert to a 2048bit cert. – sbaxter Aug 19 '10 at 13:12
I'm running about 140 websites on this server, so I can't shut it down. They all use the same wildcard cert. I was hoping that if I removed the old cert, the sites would automatically pick up the new cert since it has the same friendly name, but that didn't happen – sbaxter Aug 19 '10 at 13:19

Because you can only have one certificate per IP addresses, you will need to set up SSL host headers for all the other sites that need the certificate.

share|improve this answer
All of my sites do have host headers – sbaxter Aug 20 '10 at 16:15
here's something interesting...if i remove ssl completely from the site, I can still view the site using https and it still shows the old certificate in the browser...this makes me believe that whoever set this up before, somehow was able to make this ssl cert some kind of default – sbaxter Aug 20 '10 at 17:47
up vote 0 down vote accepted

We fixed it. We had to completely remove the old cert from the server and remove all the bindings from the ip address. Then apply the new cert to each site and reapply the bindings. It was an all day effort.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.