29

We are moving servers to another facility with different block of IP addresses. Will we need to get new SSL certificates issued and installed once the move has taken place?

If so, is there any way to get prepared for this before the server is moved instead of waiting for it to boot up to then go through the process of requesting from IIS, going to certificate vendor, etc?

36

Most (I think ALL) SSL certificates are domain-name-based, so there should be no need to get a new certificate as long as the hostname of the server will be the same after the move.

It will require a DNS change, timed with the move, however.

|improve this answer|||||
22

No, SSL is tied to the domain name, not the public IP address. For your prep though, you should set your DNS TTL to be low, so that propagation is quick.

The only time SSL and IP clash is when you are working with multiple SSL certs on a single IIS box.

6 years later, I wanted to add a quick edit to this one. I know the question wasn't about assigning an SSL cert to an IP, but that is possible.

""An SSL certificate is typically issued to a Fully Qualified Domain Name (FQDN) such as "https://www.domain.com". However, some organizations need an SSL certificate issued to a public IP address. This option allows you to specify a public IP address as the Common Name in your Certificate Signing Request (CSR). The issued certificate can then be used to secure connections directly with the public IP address (e.g., https://123.456.78.99.).""

|improve this answer|||||
  • 2
    I didn't choose your answer as THE answer but I appreciate the extra advice on TTL. – dmr83457 Nov 5 '09 at 21:55
  • so if the ip changes and i have a cert bound to the ip, i still can use the cert? – user3123159 Apr 5 '18 at 15:11
4

SSL certificates are tied to a single IP address in so far as that you can only have one certificate bound to a given IP address. The certificates themselves are expected to match the Common Name (CN) which is typically the hostname entered into DNS and configured for the service (IMAP, HTTPS, SMTP, etc).

That said the moving of servers and changing the IP address is not a problem so long as you take the necessary steps to update the DNS for the respective hostname entry to point to the new IP address. As mentioned you can limit the potential time by lowering the TTL so that the change propagates quickly, you can also make the DNS IP address change before actually moving the server so the update will go into affect before the change and thus lowering the possible unreachability.

|improve this answer|||||
  • Can you clarify what you mean by "you can also make the DNS IP address change before actually moving the server"? If I have a website https://www.hello.com hosted on a server at 12.34.56.78 and want to move it to a new server at 90.12.34.56, why would I update the DNS record for www.hello.com to point to 90.12.34.56 before having finished migrating the application and data to the new server? – mpavey Sep 13 '18 at 19:35
  • Almost 10 years after the original answer... I guess he meant that you could set up a temporary redirect at the new ip until the move is done. – aanders77 May 12 '19 at 16:37
  • 1
    @mpavey I think he was assuming that the server was to be physically relocated, not contents copied from old server to new server. By setting the DNS to the new IP when you move out of the old server room, it will have had time to propagate by the time you power up the server in the new server room, thereby minimizing the downtime. – Kidquick May 22 '19 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.