1

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the old private key?

I'm trying to think through this but I can't see a reason why this would not work as the other servers as far as they know they still have a matching key pair. It may not be the best practice, but I don't see why we can't. Looking for confirmation.

  • 1
    If you re-key the certificate, then it becomes a new certificate. What are you trying to do with this re-keyed certificate? Your question doesn't explain what you're trying to achieve. – garethTheRed Apr 27 '16 at 20:05
  • I understand it becomes a new certificate, with a new public/private key pair, however I still do not see how this would cause existing servers on which you did not install the newly keyed cert, to no longer function from an https standpoint, until the CA revokes the previously issued one. – user53029 Apr 27 '16 at 23:58
  • It won't. A certificate with the same name and a different key will work along side the original certificate with the original key pair. However, as Steffen points out below, there may be procedural constraints within the CA that issued the certificates prohibiting both. Technically, they will both work. – garethTheRed Apr 28 '16 at 6:19
3

You can have multiple valid certificates with the same subject but different keys active at the same time. A possible use with SAN certificates would be to use certificates with the same subject but different key for the different hostnames contained in the certificate. You could even use it for the same hostname (i.e. same hostname on multiple IP addresses) but this will be confusing for some certificate verification tools like certificate patrol.

  • I am referring to the same cert installed in multiple servers. Not multiple certs with the same hostnames and different key pairs for each. So lets say I have 5 servers and they all share the same cert. If I want to use this same cert on a new server because its a SAN and it validates the URL for the new server, but I want this one to have a different private key by having the cert re-keyed, would that "invalidate" all of my other servers certificate or would they still work? – user53029 Apr 27 '16 at 23:42
  • @user53029: It might be that you miss some understanding what a certificate contains. The public key is part of the certificate. You cannot have multiple private keys for the same public key. Thus having a different private key means you have a different certificate. Re-Keying a certificate means that you create a new certificate with a new key, but that the subjects from the old one are kept. – Steffen Ullrich Apr 28 '16 at 4:26
  • @user53029: and to make it more clear: Re-Keying a certificate does not need to revoke the previous certificates. But it might be that the CA you use will do this as part of re-keying so you need to check with this CA. Even it it does you can just simple create a new certificate, i.e. not re-key the old one which might cause revocation by the CA. The result is technically the same but the procedures (and prices) at the CA you use might be different. – Steffen Ullrich Apr 28 '16 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.