My website on a shared server has a SSL certificate installed and I want to move the certificate to a dedicated server that's supplied by a different hosting company. The current hosting company says that they need a new CSR. Why can't I just re-install the existing one on the new machine without creating a new CSR?

  • exactly , you can/should be able to move it as suggested, It looks like they want to create new SSL cert if they are requesting CSR (Certificate signing request). Just transport SSL key and crt and that should be enough for them to set it up properly – Hrvoje Špoljar Oct 7 '12 at 21:41

If you're on a shared host, it's likely that the certificate that's in use is also used for a number of other sites. You should be able to check the list of Subject Alternative Names (SAN) in that old certificate.

In such a situation, the certificate isn't really yours, but you've authorised your hosting company to be issued with a certificate that covers your domain name. If they gave you the corresponding private key, they'd effectively give you the ability to host all the other shared host names on that server, which is certainly not acceptable for the other customers.

Even if that certificate isn't shared with other customers, the hosting company will have access to its private key, and it could technically keep serving your domain name. It's good practice to re-key your certificate when moving from one hosting company to another, at least to take control over your old certificate away from the old company.

When moving to a new host, you would want:

  • to make sure that the old certificate is revoked, so that the hosting company can no longer server your host name with that certificate;
  • get a new certificate for your new dedicated host.

To prevent the old certificate from being used any further, it makes sense to generate a new key-pair, in addition to revoking the old certificate (since whoever controls that old certificate would also have its private key). Hence, you need to create a new CSR.

  • One would still have to trust that the original hosting company revokes the certificate though? – Ian Warburton Oct 8 '12 at 13:00
  • Yes, although in principle, it would be legitimate for the domain owner to contact the CA directly to ask for the certificate to be revoked. It would make sense for them to act upon such a request, but whether they'd do it may be another matter. – Bruno Oct 8 '12 at 13:03

It's probably because they have a system that does not allow to recover the original private key. If they use a kind of HSM (Hardware Security Module) then they entered the private key into the system once they generated it and then shred the key or even the HSM has a functionality to generate a request not exporting the private key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.