1

I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity.

However, soon a few of the SSL certs for the inactive domains are set to expire. Are there any security considerations for simply allowing them to expire?

Any other considerations for the actual expired cert files on the servers?

Improve this question
1
  • 3
    If the domains will be registered but not re-used, then there's no need to further continue the certificates. I'm not sure if you'll be redirecting old domains to new ones, or still hosting static content (archive) on those domains. But if there is not a need for SSL certificates on the old domains, don't spend the money to renew them.
    – ionFish
    Commented Aug 4, 2012 at 16:27

1 Answer 1

Reset to default
1

No, there isn't. Just let the certificates expire (don't renew them) and they'll become useless.

Note that you should also remove (at least) all A/AAAA/MX/CNAME records for your domains if you don't want users to go to old domain and get SSL certificate warnings (or invalid or outdated content) and thus get worried (lowering your reputation).

Also, if you want to retire domains much sooner (eg. domain expires before certificates) and do not want bad people (that somehow had access to your old certificates/private keys - should not happen normally, but depending on your situation may be possible - like laid off disgruntled sysadmins) to buy expired domains and impersonate you with valid SSL, you should also revoke said SSL certificates before they expire.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.