up vote 1 down vote favorite
share [g+] share [fb]

I am attempting to move an SSL certificate (issued by Network Solutions) from one IIS 6 / Win2k3 server to another. Exporting it as a pfx file allowed the transfer, but the certificate seems to fail it's checksum when imported on the target server. I've also attempted to use the "move certificate to a remote server" option, but as these are on two completely different networks, behind VPNs and firewalls, that doesn't seem to be a viable approach. Does anyone have any ideas why the pfx file approach would fail (multiple times with the same error)?

link|improve this question
why was this closed, I disagree that it is not programming related as it is reflects issues I have come across ?? – redsquare Oct 13 '08 at 22:41
I think this is one of those grey area questions. As a dev I work with SSL management all the time using scripts. Should have given the voting system a chance to decide this questions fate. – Kev Oct 14 '08 at 0:30
feedback

migrated from stackoverflow.com Aug 27 '09 at 16:29

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 1 down vote

Take a look at this page, it documents the process step-by-step. It looks really complicated but I have done this many times with no problem.

http://www.sslshopper.com/move-or-copy-an-ssl-certificate-from-a-windows-server-to-another-windows-server.html

Update: Found another link which is exactly the same process, only without the screenshots: http://www.webhostingtalk.com/showthread.php?t=403531

link|improve this answer
feedback
up vote -1 down vote

Does the server have the same name? I know for VeriSign the server has to have the same name, the domains have to be the same, the OS has to be the same, and the IIS version has to be the same. I would check w/ your vendor, they may have some further/more specific instructions and help.

link|improve this answer
Not sure what you're referring to. I have exported SSL certs from a Win2k box running IIS5 to a Win2k3 box running ISA Server. It works flawlessly, different name, different OS, no IIS at all on the destination box. – Graeme Donaldson Aug 27 '09 at 20:11
According to what I read from VeriSign, that's what they said of transfering the certificate. It might just be VeriSign and how they do it, or it might have been something specific to our cert. But that's what I read from their site. Note: This was probably about a year ago, so it could have changed. – Dustin Aug 27 '09 at 20:51
1  
-1 : Only the published URL needs to match not the server name. You should be able to load the same certificate on n+1 number of servers as long as the url used to access the servers matched the common name of the certificate. – Dscoduc Aug 27 '09 at 21:24
knowledge.verisign.com/support/ssl-certificates-support/… As I mentioned, for VeriSign (which figured there could be similarities and he should check the vendor for details) I gave what I remember. I was wrong about the OS, but it speficially mentions in the article that it needs to be the same server software (IIS to IIS, Apache to Apache). It also mentions, you must license EVERY server you plan to secure. It might be the same certificate, but you still need to license it. Hence: "Check with your vendor for spefici instructions and help." – Dustin Aug 28 '09 at 13:02
So I reviewed the link and you left out an important part: "Per VeriSign's Certificate Practices Statement (CPS)...". So what you are referring to is not a technical limitation but a policy limitation by Verisign. – Dscoduc Sep 1 '09 at 4:00
feedback

Your Answer

 
or
required, but never shown