Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are moving servers to another facility with different block of IP addresses. Will we need to get new SSL certificates issued and installed once the move has taken place?

If so, is there any way to get prepared for this before the server is moved instead of waiting for it to boot up to then go through the process of requesting from IIS, going to certificate vendor, etc?

share|improve this question
up vote 19 down vote accepted

Most (I think ALL) SSL certificates are domain-name-based, so there should be no need to get a new certificate as long as the hostname of the server will be the same after the move.

It will require a DNS change, timed with the move, however.

share|improve this answer

No, SSL is tied to the domain name, not the public IP address. For your prep though, you should set your DNS TTL to be low, so that propagation is quick.

The only time SSL and IP clash is when you are working with multiple SSL certs on a single IIS box.

6 years later, I wanted to add a quick edit to this one. I know the question wasn't about assigning an SSL cert to an IP, but that is possible.

""An SSL certificate is typically issued to a Fully Qualified Domain Name (FQDN) such as "". However, some organizations need an SSL certificate issued to a public IP address. This option allows you to specify a public IP address as the Common Name in your Certificate Signing Request (CSR). The issued certificate can then be used to secure connections directly with the public IP address (e.g., https://123.456.78.99.).""

share|improve this answer
I didn't choose your answer as THE answer but I appreciate the extra advice on TTL. – dmr83457 Nov 5 '09 at 21:55

SSL certificates are tied to a single IP address in so far as that you can only have one certificate bound to a given IP address. The certificates themselves are expected to match the Common Name (CN) which is typically the hostname entered into DNS and configured for the service (IMAP, HTTPS, SMTP, etc).

That said the moving of servers and changing the IP address is not a problem so long as you take the necessary steps to update the DNS for the respective hostname entry to point to the new IP address. As mentioned you can limit the potential time by lowering the TTL so that the change propagates quickly, you can also make the DNS IP address change before actually moving the server so the update will go into affect before the change and thus lowering the possible unreachability.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.