7

Over the past year I have created multiple SSL certificates that are all valid for a year. In a week or so, the first will expire. I thought it would be practical if all my certificates would have the same expiration date. That way, I know of one day I have to renew all certificates; it's easier to not make a mistake that way.

So, is it okay if I would now renew a certificate that is still valid for half a year or so?

Should I revoke the old one? My certificates were free (via StartSSL), but revocation isn't. As far as I know nobody got hold of the certificates, so do I really need revocation? Wouldn't it be sufficient to keep copies somewhere offline and not revoke the certificates?

10

Is it OK to create a new SSL certificate before the old one expires?

Yes. There is nothing to technically prevent you from doing this. And if you are large company, then you may want to do generally do this as an insurance against CA-failure. If for example your CA of choice is hacked and suddenly revokes all its certificates, then you can just deploy the other certificate (from another large CA) that you have lying around for just such an unlikely event. (For example if you are FaceBook, you may want something like this.)

So, is it okay if I would now renew a certificate that is still valid for half a year or so?

If you want to warn people not to use this certificate anymore, then you should pay for revocation.

Expiration is the implicit "Don't use this anymore"-rule. Revocation is the explicit "Don't use this anymore"-rule.

Example: If your server was hacked, then you should consider your certificate's private key stolen. Then anybody who afterwards still encounters the compromised certificate in the wild should be warned.

Otherwise (if you can also vouch for the safety of your offline archival) then you can just let the certificate expire.

UI override for expired. But not for revoked.

Expired certificate errors are displayed differently in browsers. For example Google Chrome will currently allow the user to manually override an expired certificate warning. But it will NOT allow override for an explicitly revoked certificate.

0

Yes you can do that without needing to revoke the old one as long as they have (both) the same domain name on them.

  • 2
    ... can you explain that further? – Mike Ounsworth Aug 5 '15 at 14:11
0

In general it's fine to get a new cert before the old one has expired and revocation is not needed. Revocation is a relatively expensive process infrastructure wise (inclusion in widely distributed CRLs) and should normally only be used when there is a reason to believe the private key is compromised.

Unfortunately startssl won't issue a new certificate with the same common name and the same validation level unless the old one is either revoked or about to expire. You can work around this on their paid tiers by issuing a cert with a different common name and the name you really wanted as an alternative name but they don't allow that on their free tier.

I don't see any legitimate reason for this behaviour other than as a way to push free tier users into paying them money.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.