I need to generate an ssl csr for a wildcard certification which I can do using openssl and ssh (I don't use any web based control panels such as cPanel).

Now I'll be getting a new server next week so my question is if I generate a CSR and get an ssl certificate and install it on server #1, next week when I move everything over (including IP addresses) will it affect the SSL?

I'm not sure what info is in the CSR and whether it has any server hardware ID's etc or if it is entirely just domain name driven.

Also interested if SSL's are bound to specific IP addresses, meaning if I change IP addresses later will it affect the SSL.



No, SSL certificates have no identifying information that tie them to a particular machine or even IP address. As long as the DNS name doesn't change relative to the CN/subjectAltNames on the certificate, users won't notice a thing.

  • most certificate don't have IP address in them. A X509 certificate can have many identifiers, IP addresses, X500 DNs and DNS names among other things – Hubert Kario Jul 22 '11 at 7:13

SSH and SSL use the server's private key as the identifier. openssh implementations remember the IP address, corresponding public key for the server, and the DNS name, if given. Default settings usually mean SSH will kick up a fuss when connecting. This can be overwridden in /etc/ssh/ssh_config (See man ssh_configfor details).

Known hosts information is remembered in $HOME/.ssh/known_hosts and system-wide hosts are remembered in /etc/ssh/known_hosts

So if you want to keep the same domain name, IP address and keep any clients from complaining, transfer the same certificates, self-signed or otherwise from the old server to new one.

  • I'm pretty sure the OP isn't asking about SSH known_hosts; the only mention of SSH is in the context of running openssl. – womble Jul 22 '11 at 1:50

You don't need the CSR as it will be used only to generate the certificate, but you need to keep a copy of your SSL key & certificate from your old server and need to copy that to your new server. Otherwise you are going to end up getting errors when you install the certificate in the new server.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.