1

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the old private key?

I'm trying to think through this but I can't see a reason why this would not work as the other servers as far as they know they still have a matching key pair. It may not be the best practice, but I don't see why we can't. Looking for confirmation.

Improve this question
3
  • 1
    If you re-key the certificate, then it becomes a new certificate. What are you trying to do with this re-keyed certificate? Your question doesn't explain what you're trying to achieve.
    – garethTheRed
    Apr 27, 2016 at 20:05
  • I understand it becomes a new certificate, with a new public/private key pair, however I still do not see how this would cause existing servers on which you did not install the newly keyed cert, to no longer function from an https standpoint, until the CA revokes the previously issued one.
    – user53029
    Apr 27, 2016 at 23:58
  • It won't. A certificate with the same name and a different key will work along side the original certificate with the original key pair. However, as Steffen points out below, there may be procedural constraints within the CA that issued the certificates prohibiting both. Technically, they will both work.
    – garethTheRed
    Apr 28, 2016 at 6:19

1 Answer 1

Reset to default
3

You can have multiple valid certificates with the same subject but different keys active at the same time. A possible use with SAN certificates would be to use certificates with the same subject but different key for the different hostnames contained in the certificate. You could even use it for the same hostname (i.e. same hostname on multiple IP addresses) but this will be confusing for some certificate verification tools like certificate patrol.

Improve this answer
3
  • I am referring to the same cert installed in multiple servers. Not multiple certs with the same hostnames and different key pairs for each. So lets say I have 5 servers and they all share the same cert. If I want to use this same cert on a new server because its a SAN and it validates the URL for the new server, but I want this one to have a different private key by having the cert re-keyed, would that "invalidate" all of my other servers certificate or would they still work?
    – user53029
    Apr 27, 2016 at 23:42
  • @user53029: It might be that you miss some understanding what a certificate contains. The public key is part of the certificate. You cannot have multiple private keys for the same public key. Thus having a different private key means you have a different certificate. Re-Keying a certificate means that you create a new certificate with a new key, but that the subjects from the old one are kept.
    – Steffen Ullrich
    Apr 28, 2016 at 4:26
  • @user53029: and to make it more clear: Re-Keying a certificate does not need to revoke the previous certificates. But it might be that the CA you use will do this as part of re-keying so you need to check with this CA. Even it it does you can just simple create a new certificate, i.e. not re-key the old one which might cause revocation by the CA. The result is technically the same but the procedures (and prices) at the CA you use might be different.
    – Steffen Ullrich
    Apr 28, 2016 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .