If you've installed digital certificates on your servers, are there any potential problems when replacing one digital certificate and its key with another? Are there any hidden ramifications? I'm building a website that will hold sensitive data. I have a web server running Nginx, a fileserver that I cross-mount via NFS that serves up static files, and a PostgreSQL database server. Ideally, I'd like to purchase a wildcard certificate with Business/Organization Validation but they're pretty expensive. What I'm thinking of doing instead is purchasing a cert with Domain Validation to start and then figure out how to get SSL running on all three servers. Once I understand that process and start getting customers, I would then replace the DV cert with a BOV cert. What problems, if I, will I encounter if I take this approach?

  • An OV cert is a complete waste of money. It confers no real advantage over a DV cert. If you're going to spend money and jump through hoops, get an EV cert to get the green bar in the browser. – Michael Hampton Jan 9 '17 at 19:23

In essence, you're free to replace SSL certificates at will. But if you're going to replace it with one that is less supported by the browsers of your users, you have a problem. For instance, if you were to replace an existing certificate with a Startcom one now, a lot of users will not be able to visit your site, because the Startcom root certificates are not trusted anymore by major browsers, because they violated the rules of the trade.

Another issue can be lack of support for wildcard certificates. Mostly some obscure platforms don't support those. Symbian and Windows CE and stuff. I don't remember the list.

Expensive certificates being a waste of money aside (I even think going beyond domain validation is a waste; users don't know the difference), your approach is valid. After having installed any certificate, you can use a test like SSLLabs to verify all is correct.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.