I see that except public key mostly everything else changes after the certificate renewal; should I reconfigure the programs/softwares to use the renewed certificate? if there is 'something' that stays the same after the renewal, I can use 'that something' to identify the certificate. can any one help me here?
3
-
What are you trying to achieve, exactly? The common name is used to identify the certificate belongs to the site, usually. The public key could change on renewal, but usually doesn't.. But the only channel to match a certificate to a destination is the common name (CN)– user2867314Mar 8, 2017 at 10:02
-
currently I am trying to find the ramifications of certificate renewal and possible changes or reconfiguration our software will have to go through after the certificate renewal.– Venkatesh LaguduvaMar 8, 2017 at 10:04
-
1Depends on what you are trying to do. If you are using certificate/public key pinning in client application then public key should be same. if you are using web server or something similar as SSL termination point, then certificate is typically tied to interface (and renewal has no impact). If you are using certificates as part of server identification, you can use CN or Subject Alternate Name as the common value.– jhashMar 8, 2017 at 22:47
Add a comment
|
1 Answer
Most software, particularly web browsers use the Common Name, and Subject Alternate Name fields to ensure the certificate is valid for a site.
If the identified (be it IP address or hostname - whichever is used to access the site) aligns with a CN or SAN and the certificate otherwise passes validation (accepted certificate authority, start and end dates, etc) then that certificate is considered valid.
Most likely this is mandated by the RFC, but I'm not particularly familiar with that, so I'm speaking only from observation - not with any authority.
Note that this is a massive oversimplification, HSTS and certificate pinning often play a role these days too, which can make an otherwise valid certificate invalid.
