First off, allow me to explain that I'm the middleman in the process looking for clarification. I have a client who wants to renew one of their SSL certificates (Geotrust) on a website that we host on our server.

Apparently, the process is that we generate the CSR, send it to them and they then give us the cert to install on the server.

Our new IT guy didn't know about this and went ahead renewed the cert (without sending the CSR to the client).

My question is this: does this make a difference at all in terms of the website's functionality? Or is the only issue here a billing one? (in this case, we foot the bill for renewing the cert).


The CSR (Certificate Signing Request) is what you send to the Certificate Authority to request that they issue you a certificate. It's just a copy of the public key and some ancillary information.
Sending the CSR without your client giving it a kiss of approval does not affect the functionality of the signed certificate and public/private key pair (though if the information in the request is incorrect - for example if it has an old address for your client - they may take exception to that and as you to have the error fixed).

Many companies offer what your guy did as a service (managing the SSL certificate renewal process and sending it the CA on behalf of the client), particularly if the client is non-technical and would be intimidated by the process of sending the CSR to a Certificate Authority to be signed. It can be a huge time-saver if you would otherwise have to hold your client's hand through the process.

Regarding who foots the bill, if your contract says the CSR has to go to the client for approval you screwed up. Discuss it with the client, but be prepared for them to refuse to pay you for your screw-up (this would be somewhat unreasonable in my opinion, and if they refused to pay on the grounds that you shouldn't have done it I would not install the certificate: Re-do the process following their procedure and eat the loss on the extra certificate that you'll have to throw away).

If your contract doesn't require the client to approve the CSR, I would suggest invoicing the client for the cost of the renewal as a service you performed for them.

If you don't have a contract, invoice them for the service AND draft a contract for services to be provided :-)

If this is not a service you want to provide in the future you should make it clear to your client that it was done in error, and in the future the CSR will be sent to them to be forwarded to the CA of their choice for signing.

  • A great and detailed response...thank you, @voretaq7. I will take your suggestions into account and include that in future contracts :) – Ray Jul 26 '11 at 16:42
  • @Ray - this can actually be a very lucrative business area (charge 10% on top of the certificate for the renewal service). If your company may be leaning in that direction I suggest working with a single CA though - it gets really hairy when you have certificates scattered all over the place. – voretaq7 Jul 26 '11 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.