Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have changed to CA2 and would be importing this new cert into my web server. In this case during this interim, would the client have any impact if my web app firewall is still using the cert from CA1? I suppose which CA does not matter as long as the cert is trusted?

enter image description here


As long as they are valid certificates issued by a trusted CA and you aren't using something like HPKP, there will be no impact on the client.

In fact, it looks like the client won't even see the cert on the server itself. It will only see what the WAF is using.

| improve this answer | |
  • The WAF is only doing SSL traffic inspection, so I guess the client would still see my web server cert signed with CA2? Unless the WAF is configured to terminate SSL traffic. Correct me if I am wrong. thanks – Pang Ser Lark Nov 6 '15 at 0:08
  • 1
    See this answer: security.stackexchange.com/a/44566/90657 – multithr3at3d Nov 6 '15 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.