I have a customer that is upgrading their infrastructure and is having problems installing the existing certificate in their new environment. We have decided to do a REPLACE. How long do we have for the existing certificate to be valid for after installing the replaced certificate on the new infrastructure?
If the Replaced certificate doesn't work on the new infrastructure, we want to be able to revert back to the existing environment.
The life time of a certificate starts with the time seen in the "Not Before" property of the certificate and ends with the time given in the "Not After" property. You can have multiple certificates for the same domain which are all valid and you can switch between these as long as these still have a valid life time and are not explicitly revoked. This means there is no implicit termination of an existing certificate if you get a new one.
But, according to an answer to SSL certificate renewal and downtime due to revocation some CA do an implicit revocation of the old certificate if re-keying is requested which makes the old certificate immediately invalid even though the life time properties might say different. Thus check before you initiate the replacement what this replacement process is actually doing at your specific CA, i.e. if it involves revocation or not. But according to Replace an SSL Certificate from Symantec Trust Center account Symantec does no automatic revocation when replacing an existing certificate:
Replacing an SSL certificate does not add the certificate to Certificate Revocation List (CRL) or immediately flag the certificate as revoked status through Online Certificate Status Protocol (OCSP) responder.
