Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a wildcard SSL certificate that is due to expire in a few weeks. I currently have this certificate installed on six servers. I'd like to renew it on one server first, test it out, and then install the cert on the other servers later. But I'm a little worried that renewing the certificate will cause it to immediately stop working on the other servers. I don't think this is the case, but when I asked GoDaddy support about it, they said "the certificates on the other servers will stop working once the new one is generated". Is that right? I called them back and spoke with a different tech and got a different answer. So who's right?

By the way, I plan to generate a new CSR rather than renewing the existing cert due to this known bug in IIS 7: http://support.microsoft.com/kb/971832

Thanks

share|improve this question
1  
I called them back and spoke with a different tech and got a different answer. This, by the way, is what's known as a "red flag." Might be worth considering a vendor that knows the first thing about the product they're selling, instead of picking GoDaddy. –  HopelessN00b Mar 12 at 17:07

1 Answer 1

up vote 2 down vote accepted

Typically generating/renewing a certificate with a subject identical to an existing cert will not result in any previously issued certificates becoming invalid.

A certificate only becomes invalidated if the CA performs a special step to list the CRL, or configures their OCSP system to report it as revoked.

share|improve this answer
    
Looks like GoDaddy does revoke the original certificate. Here was their response when I asked them about it again: "When you renew a certificate and we issue the new certificate, the original certificate is revoked within 24 hours of the renewal certificate being issued. So you would need to get the renewal certificate installed on all the servers within 24 hours of us issuing the certificate. Otherwise, any servers not updated would get a security warning of a revoked certificate." –  CowherPower Mar 13 at 13:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.