0

Most documentation on initial SSL setup is pretty good, but what about a renewal for an existing SSL? I really dont want to fix anything that doesnt need fixing. I cant exactly test this out on a staging site. Do I need to generate a new rsa key for a renewal? I'm using a godaddy wildcard cert on a single Linode server running CentOS/Apache, that hosts about a dozen Atrium sites through Aegir under individual subdomains under a single domain name. Aegir can be unforgiving when missing the small stuff, so just want be sure. If I need to upload something new, what folders do I put it in? And do I need to manually update all the virtual hosts of my existing Atrium sites, or will this happen automatically??? Here's where I'm at (with deer-n-headlights look).

I paid for the new SSL with godaddy, and downloaded 2 files 1. gd_bundle.crt 2. mydomain.crt

Inside var/aegir/config/ssl.d/godaddy I have the following files:

  1. gd_bundle.crt (this one has 3 chained certs, but the one I downloaded from godaddy only has 2. Just leave the new one as is and upload it? Thoughts?)
  2. openssl.crt (what I was planning to do is replace the contents of this file with what I have in mydomain.crt -copy/paste and upload it. Yes?)
  3. openssl.csr (I alerted godaddy to use my existing csr during activation, so I'll do nothing here. Yes?)
  4. openssl.key (I suppose this is the key generated the first time. Do I need to regenerate on a renewed SSL? Would rather not...)
  5. info.txt (this file appears to be a public cert. I don't recall how it was generated, what should I do about this mystery? It starts like so:

Certificate:

Data:
    Version: 3 (0x2)
    Serial Number:
        2x:67:z3:
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Certification Authority/serialNumber=123456
    Validity
        Not Before: Apr 16 22:18:16 2012 GMT
        Not After : May  3 17:00:47 2013 GMT
    Subject: O=*.example.com, OU=Domain Control Validated, CN=*.example.com
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
        RSA Public Key: (2048 bit)
            Modulus (2048 bit):
                00:c0:1d:5a:07:98:42:b1:be:de:b7:20:b5:79:d2:
                ae:3e:99:06:e3:4b:a8:fc:59:18:f1:3a:05:aa:50:
                94:1f:64:71:9f:ea:90:eb:06:e9:1d:a0:89:00:a8:
1
  • About the key: You don't have to replace it for technical reasons. You may choose to do so, e.g. due to internal IS practices.
    – Jenny D
    Mar 21, 2013 at 14:30

1 Answer 1

2

You use the CSR that you originally created, send it to your CA, they sign it and send you back a new certificate. The new certificate will use the same key that went with the original CSR.

You should be able to just drop the new certificate in place of the old one without changing anything else and restart your web server.

I've done this many times with Apache, lighttpd, and IIS.

Not being a Godaddy user, I'm not certain what the various files are in your folder there. You can examine them with openssl x509 -in <file> -text to find out they are.

3
  • Thanks! I'll give that a try. Any idea why the existing gd_bundle.crt had 3 chains, but the new one has only 2? I feel like I need to paste some other crt inside the gd_bundle file.
    – user656002
    Mar 21, 2013 at 15:47
  • I will speculate that they may have changed the number of subordinate CAs they are using (reducing the number), which could account for a shorter chain. But that's just a guess. Mar 21, 2013 at 17:13
  • 1
    This was quite easy. Downloaded the two certificates from GoDaddy.com. One is called gd_bundle.crt, the other is called yourdomain.crt. Upload gd_bundle.crt into the same folder as your expiring certificate (this will overwrite the existing file with the same name). The two folders to put this cert is in ssl.d/nameofcertfolder and also in servermaster/ssl.d/nameofcertfolder. Now rename the second godaddy cert file from yourdomain.crt to openssl.cert. Upload it to your same folders mentioned above. Restart Apache, then check everything is working at sslshopper.com/ssl-checker
    – user656002
    Mar 26, 2013 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .