Manual certificate replacement

Replacing a certificate is not the same operation on every system. Some products read PEM files, some use a Windows certificate store, and others keep certificate objects behind a management API. The step that actually activates it might be an IIS binding change, a graceful reload, a rolling restart, a policy deployment or a cluster-wide update.

These guides are for doing it by hand, with no aethercert involved. Each one follows the same shape: what to have ready, what the product actually does with a certificate, the replacement steps, how to verify it over the network, how to roll back, and what usually goes wrong. Each ends with a short note on what the matching aethercert deploy target automates, and cites the vendor documentation it is based on.

Use the guide for the system that terminates TLS. If a load balancer sits in front of a web server and terminates there, the load balancer's guide is the one you want.

Microsoft and Windows

Web servers and containers

Load balancers, firewalls and appliances

Virtualization and orchestration

Things that apply almost everywhere

A few points come up in most of these procedures, so they are worth stating once.

• Importing a certificate is not activating it. Almost every product needs a second step - a binding, an object reference, a service restart - and skipping it leaves the old certificate in service while everything looks done.

• Serve the chain, not just the leaf. A certificate that validates in your browser because your browser already cached the intermediate will fail for a client that has not.

• Verify over the network, by hostname. Checking the store or the file on disk proves the import worked, not what the service presents.

  openssl s_client -connect app.example.com:443 -servername app.example.com -showcerts

• Keep the old certificate and key until every node is verified. That, plus the previous binding identifier, is what makes a rollback possible.

• Do every node. A load balancer will happily keep routing to the one server you missed.

Automating this instead

Each guide ends with a note on what the matching aethercert deploy target does. The catalogue, the fields each preset takes and how far each has been verified are on Deploy targets.