2

I have an existing site with an SSL certificate, and the domain will be transferring to a different host.

Does the SSL certificate carry over with the domain? Or does this need to be installed on the new host?

Improve this question
0

1 Answer 1

Reset to default
3

A domain is an abstract entity. So to say, and to simplify (a lot), just one row in the registry database. Hence you can not "attach" a certificate to it.

Registering a domain by itself does not create any content or any service. It is only when the domain is delegated to some nameservers and when those nameservers start to publish some valid zone content, mapping names at or below this domain, to some resources, typically IP addresses but also other things (SPF or DKIM configurations, DANE, SRV or soon HTTPS/SVCB records, etc.).

When an HTTPS server is set up that way, it has to have everything needed to operate correctly, which is to say the server certificate (and its associated private key) has to live on the server(s) answering for the given name.

You may be mixing different things that render the situation more complex than it appears. The followings are completely separate jobs:

  • being a domain name registrar is for a company to let you register domain names for a fee, and maintain it during its life, and among other things, let you assign authoritative nameservers to your domain
  • being a DNS provider is for a company to provide you with a list of authoritative nameservers that you will need to attach to your domain to start to have service, and giving you some UI and/or API to be able to change the zone content
  • being a webhosting company, or webhoster is for a company to give you space on their servers and make them configured to answer HTTPS requests for names in your domain

These jobs can all be done by the same company (and often are) yet they are still completely different jobs, and having the same company do all can provide both benefits and drawbacks.

So, to be precise, a "domain name transfer" or "registrar change" is just changing the registrar, without any change in the current nameservers authoritative on your domain. Of course, if your current registrar is also your DNS provider and/or web hosting company, the mere fact of transferring the domain out of this registrar to another one might also trigger shutdown of the DNS service/webhosting service for your domain, which would be catastrophic, so read your term and conditions and what happens if this case. If your DNS provider and webhoster is not your registrar, then a registrar change has no consequences.

A nameservers change, that is a typically a DNS provider change, may have consequences only if the current DNS provider is also your webhoster. If not, changing nameservers has no impact on your webhosting.

A webhosting company change means you need to change records in your zone to point your names to a new set of IP addresses for a new provider to handle HTTPS requests on your names. The new provider servers will need to have a proper certificate set up for your domain in order for HTTPS requests to be fullfilled correctly. Note that it does NOT need to be the same certificate as current one on other webhosting company: any (in general) valid new certificate will be ok so you just need to make sure your new webhosting company has set up things correctly (it won't be able anyway to get the certificate from the old company as this would mean transferring also the associated private key which would definitively be bad practice; if you on the contrary control the certificate and the private key then you could communicate them to the new webhoster; yet this is still not ideal security-wise, you shouldn't ever have to store this data on your side, it should exist only on the relevant web servers).

So, (yes this TL;DR is on purpose at the end), for

Does the SSL certificate carry over with the domain? Or does this need to be installed on the new host?

the answer is: since the certificate does not move no matter what (because not attached to the domain but the current webhosting company so to say), the new web host need to be configured with any other certificate relevant for your name (said differently: even if we could move the certificate, we don't care, any other one is good enough).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.