As long as the certificate has a trusted root, the users shouldn't be prompted one way or the other.

If you're running a self-signed certificate, or once the certificate is expired, then the user should see a warning.

Hi Mark, Thanks for the info. I think we'll proceed ahead with the renewal and see what happens. By the way, we using 3rd party CA.

I've done this a number of times now - you should be good.

for what it's worth, what i have done is to create the new .kyr & .sth files with a slightly different name, so i can copy them out to the server data directory and not overwrite the current certificate files.

Then i update the certificate name on the internet sites doc, and a few minutes later issue a 'tell http refresh' at the console. The new certificates should be picked up.

Then, if there are any issues I can revert the names back on the internet sites doc.

Another option of course is to just replace the current .kyr & .sth files with files of the same name. I'd rename the old files first, so that you can rename them back if troubles occur.

Having said all that, i don't think I've ever had any trouble with the new certificates.