2

We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration. We're thinking about using a different CA since we've since purchased other certs through another CA and it'd be nice to consolidate. We can purchase the same wildcard cert from another CA three months in advance of our current wildcard cert expiring.

Our question is this: are there any issues with having two wildcard certs from two different CA's during those three months that their validity overlaps?

Only one of the certs will be 'active' on a given server at a time. We're just trying to give ourselves more time to switch out the certificates.

Wouldn't this be an issue? Clients wouldn't know that there's two certificates for the same domain issued by two different CA's and throw a warning flag? They would just see whichever certificate is currently 'active' on the server and as long as it's valid, it should be used?

Improve this question

3 Answers 3

Reset to default
2

You are describing a situation in which you have two separate, valid wildcard certificates signed by separate CAs. Unlike what the current title claims it is not the "same wildcard cert".

There is nothing that stops you from having multiple certificates for the same domain(s).

Clients will verify the validity and trust of the certificate presented by your server according to the steps described in the certification path validation algorithm Wikipedia article.

For a given domain, if a signing root CA for a certificate sent by the server and its intermediate CAs, was trusted by the client, the certificate will be considered valid and trusted.

Unless there was some custom implementation on the client side, it will not consider previously received certificate at all.

Improve this answer
2

Clients wouldn't know that there's two certificates for the same domain issued by two different CA's and throw a warning flag?

Not usually.

They would just see whichever certificate is currently 'active' on the server and as long as it's valid, it should be used?

Yes, usually.

CAs do not typically publicize their clients and certificates, or share notes. You could get a thousand certificates from a hundred different CAs, and switch between them every five minutes, if you want.

(The Certificate Transparency project to create public, auditable logs of certificate issuance is changing this, but few CAs participate yet, and CT doesn't restrict issuance, only document it.)

It's common for large websites to have multiple valid certificates. They may use different certificates in different data centers, or be in the middle of a careful transition, as you are. For example, www.google.com issues new certificates weekly, each of them valid for several months; or see the earlier Stack Exchange questions Why does Facebook serve several SSL certificates? and Why does Google SSL cert change so frequently?.

There are two issues you may encounter. My last link demonstrates the first one: The question was asked by someone using the Firefox extension Certificate Patrol, which does alert users when websites replace their certificates. But it's not widely used, and its users should be familiar with the headaches it causes.

Second, the HTTP Public Key Pinning (HPKP) standard changes everything. If you set it up, it can prevent modern clients from accepting new CAs or certificates for your hosts. To make changes, you would have to update your HPKP configuration and wait until the old one has expired on all clients, or suffer the consequences.

Finally, i think it's unusual that your CA is preventing you from buying another certificate — there is no technical reason for it, and they are turning down money — but that's on them. Maybe you can use their "buy a new certificate" interface instead of their "renew your current certificate" one?

In the future, your new CA may not restrict you like this.

Improve this answer
0

You would be able to get another Wildcard SSL certificate from another CA. But you will only able to install single certificate at the time. So either you have to remove existing Wildcard SSL and have to install a new one. OR… wait till expiry of existing certificate.

There is no technical hurdle in getting another certificate at this time but you won’t be able to use both at once. So it is better to wait for couple of month and let the expiry date comes closer.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .