Tonight I updated our TSL certificate. We deploy behind haproxy with a certificate bundled with an intermediate CA crt and private key in .pem file format. Having downloaded the renewed certificate for our domain, I made a new .pem file by just updating the corresponding part of the .pem file from the previous year. It seems to be working fine.
However, I noticed in an e-mail that we've also been issued with a new intermediate CA certificate. Do I need to update the .pem file to reflect this new certificate, or can I leave it as is? As I say, it seems to be working fine, but I'd hate to run into issues down the road because the old intermediate CA certificate expires in a couple of months or something similar.
Apologies if this is a stupid question- I'm really a junior web developer press-ganged into this sort of server admin by necessity ... Many thanks in advance.
EDIT: Possibly related: Last time I checked, our ssl setup got an A on Qualys, but now it's only getting a B, complaining that it can't verify the chain properly. I'll update to the new CA tonight. I can't upvote with only one rep, but many thanks to those who've taken the time to respond.
POST EDIT: I've updated the intermediate cert, but it wasn't the source of my Qualys issue. Thanks again.
junior web developer
that sucks they expect you to do this.. You should've rotated your entire pem file with new keys and the entire chain provided,