: Changing CA for a website As an AWS user I am currently thinking about breaking up with my current Certificate Authority in favor of AWS ACL due to ease of maintenance for the latter (just

@Courtney195

Changes of certificates happen all the time (and even more now with newer CAs like Let's Encrypt that gives 90 days validity for certificates), and this can be a change of CA too, it will be mostly transparent to anyone as long of course as the new CA is installed as root certificate in all clients.

Some advanced users (for example the CertPatrol extension of Firefox) or online tools may detect the change when they store the previous certificate and see it has changed.

You may have problems however if you use DANE or CAA records in your DNS zone, as these things will need to get updated properly when you change the chain of certificates.

And if you feel curious or need numbers, this case would be ideal for an A/B test: you decide to provide x percent of time the old certificate, and for the rest the new certificate and you compare results for users of your site.

Vote Up Vote Down