Changing a multi-domain certificate requires a planned reissue and deployment. Adding a hostname to DNS or the hosting panel does not add it to an already issued certificate.
IN THIS ARTICLE
01 Prepare the complete replacement
- Inventory every endpoint using the current certificate and record its serial number. Include duplicate deployments, load balancers and disaster-recovery systems.
- Prepare the complete desired hostname list. Mark names being added, retained and removed, and confirm that you still control each requested domain.
- Check the product's supported name count, any additional charge and the issuer's revocation behaviour for this change. Obtain the commercial change through our current order process.
- Generate the required CSR and submit the reissue request. Complete validation for new or expired domain authorisations.
- Deploy the replacement certificate and correct chain everywhere the old certificate is used. Test both the new name and all retained names.
- Verify what happened to the previous certificate and update monitoring and inventory. Removing a name from the new certificate does not by itself change DNS or application access.
02 Example: add a new hostname to an existing certificate plan
Before requesting a certificate change, list the exact names that must remain covered and the new names you want to add. Check whether the purchased certificate supports the intended count and type of names, including any wildcard requirement.
Follow the issuer's current modification or reissue workflow. A DNS change alone does not add a hostname to an already issued certificate. Complete any required validation for the revised names and install the resulting certificate through the appropriate hosting control.
What should I verify before retiring the previous certificate?
Test each important hostname over HTTPS and inspect the certificate actually served. Keep the matching key and intermediate-chain requirements in mind. If several servers or a CDN serve the site, confirm which certificate each connection uses.
Do not remove a name that still serves a production website, API or other certificate-dependent service. Contact us with the certificate order, existing names and intended changes when you need help. We can check the supported order workflow; please do not send private keys or assume extra names are free without reviewing the certificate's current commercial terms.
Common questions
Can removing one name affect other websites?
Yes. For DigiCert's documented multi-domain workflow, removing or changing domains can revoke the original and its duplicates. Coordinate the replacement across every dependent endpoint.
Can I add names to any single-domain certificate?
Only if the ordered product supports that capability. A product change may be required. Confirm the supported route before generating several replacement requests.
Will the old and new certificates overlap?
Do not assume a particular overlap period. The issuer's rules depend on the reason and kind of reissue. Plan the rollout around the actual order behaviour.