Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity.

However, soon a few of the SSL certs for the inactive domains are set to expire. Are there any security considerations for simply allowing them to expire?

Any other considerations for the actual expired cert files on the servers?

share|improve this question
3  
If the domains will be registered but not re-used, then there's no need to further continue the certificates. I'm not sure if you'll be redirecting old domains to new ones, or still hosting static content (archive) on those domains. But if there is not a need for SSL certificates on the old domains, don't spend the money to renew them. –  ionFish Aug 4 '12 at 16:27

1 Answer 1

No, there isn't. Just let the certificates expire (don't renew them) and they'll become useless.

Note that you should also remove (at least) all A/AAAA/MX/CNAME records for your domains if you don't want users to go to old domain and get SSL certificate warnings (or invalid or outdated content) and thus get worried (lowering your reputation).

Also, if you want to retire domains much sooner (eg. domain expires before certificates) and do not want bad people (that somehow had access to your old certificates/private keys - should not happen normally, but depending on your situation may be possible - like laid off disgruntled sysadmins) to buy expired domains and impersonate you with valid SSL, you should also revoke said SSL certificates before they expire.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.