1

Tonight I updated our TSL certificate. We deploy behind haproxy with a certificate bundled with an intermediate CA crt and private key in .pem file format. Having downloaded the renewed certificate for our domain, I made a new .pem file by just updating the corresponding part of the .pem file from the previous year. It seems to be working fine.

However, I noticed in an e-mail that we've also been issued with a new intermediate CA certificate. Do I need to update the .pem file to reflect this new certificate, or can I leave it as is? As I say, it seems to be working fine, but I'd hate to run into issues down the road because the old intermediate CA certificate expires in a couple of months or something similar.

Apologies if this is a stupid question- I'm really a junior web developer press-ganged into this sort of server admin by necessity ... Many thanks in advance.

EDIT: Possibly related: Last time I checked, our ssl setup got an A on Qualys, but now it's only getting a B, complaining that it can't verify the chain properly. I'll update to the new CA tonight. I can't upvote with only one rep, but many thanks to those who've taken the time to respond.

POST EDIT: I've updated the intermediate cert, but it wasn't the source of my Qualys issue. Thanks again.

Improve this question
5
  • Who is your CA?
    – Rilindo
    Mar 25, 2018 at 22:37
  • junior web developer  that sucks they expect you to do this.. You should've rotated your entire pem file with new keys and the entire chain provided,
    – Jacob Evans
    Mar 26, 2018 at 2:43
  • @Rilindo: Starfield Secure Certificate Authority - G2
    – rwold
    Mar 26, 2018 at 9:20
  • @JacobEvans Submitting the old csr was part of the renewal process, so I figured I was fine to use the same RSA key at least- are you saying I should have generated a new one?
    – rwold
    Mar 26, 2018 at 9:21
  • Yes you should always generate new keys.
    – Jacob Evans
    Mar 26, 2018 at 20:00

1 Answer 1

Reset to default
1

In general, the intermediate CAs rarely change, but it is good practice to replace the old ca bundle with the new one. Download the new bundle and lay it down right on top of the old - using the same name. You will need to restart haproxy and any other things that use the cert.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .