# Generate certificate on local machine **URL:** \ **Category:** Server\ **Created:** [September 17, 2016, 6:40pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945 "2016-09-17T18:40:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Byu](https://avatars.discourse-cdn.com/v4/letter/b/9fc29f/32.png) [@Byu](https://community.letsencrypt.org/u/Byu)\ **Post date:** [September 17, 2016, 6:40pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/1 "2016-09-17T18:40:43Z")
Hello. I’m new to LetsEncrypt. I have installed certificates 2 months ago. For a domain and a few subdomains. They are all on one server, but I want to move one subdomain to a separate VPS. So I guess the simplest way to make it work would be to renew the certificates on primary VPS, move the subdomain to another VPS and copy generated certificates there. And when time comes to renew them again, I would have to copy them again to the secondary server. Am I right? This got me thinking, couldn’t I just install certbot on my computer, generate certificates from there and upload them every 2 months to my servers? If that’s possible, how could I do that? ---
**Author:** ![tialaramex](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@tialaramex](https://community.letsencrypt.org/u/tialaramex)\ **Post date:** [September 17, 2016, 8:02pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/2 "2016-09-17T20:02:44Z")
To issue certificates Let’s Encrypt need proof you control each name in the certificate. Machines which serve up a website with that exact name can easily prove this. So the new VPS should be able to run certbot or another client to get certificates for the site it serves, no problem. You can also prove control to Let’s Encrypt via DNS changes. If you’re comfortable doing this from some other computer you can issue the certificates there. But if that’s not something you’ve done before it’s probably not the easiest option. ---
**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\ **Post date:** [September 17, 2016, 8:21pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/3 "2016-09-17T20:21:22Z")
> [@Byu](#): > > This got me thinking, couldn't I just install certbot on my computer, generate certificates from there and upload them every 2 months to my servers? If that's possible, how could I do that? You could use the [GetSSL](https://github.com/srvrco/getssl) client - it's specifically designed for running on one computer, and validating via DNS or anther server, and uploading the certs to those servers automatically. On the other hand, unless you want all the different subdomains on the same cert, I'd have thought it was as easy in this case just to install certbot on each VPS and create the certs for the server on the server ( assuming they are standard, modern VPS ) ---
**Author:** ![Byu](https://avatars.discourse-cdn.com/v4/letter/b/9fc29f/32.png) [@Byu](https://community.letsencrypt.org/u/Byu)\ **Post date:** [September 17, 2016, 9:13pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/4 "2016-09-17T21:13:26Z")
Oh, so I can have a cert per subdomain? I thought I had to have one cert for top level domain. So if I wanted to generate certificates on my computer, I would have to generate new ones/not worry about renewing existing ones? Does certbot support DNS validation or I have to use GetSSL? By the way, when the certificate file is updated (and path to cert file doesn’t change), do I have to restart Apache server? ---
**Author:** ![serverco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/serverco/32/4251_2.png) [@serverco](https://community.letsencrypt.org/u/serverco)\ **Post date:** [September 17, 2016, 9:18pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/5 "2016-09-17T21:18:17Z")
> [@Byu](#): > > so I can have a cert per subdomain? I thought I had to have one cert for top level domain. Yes. > [@Byu](#): > > So if I wanted to generate certificates on my computer, I would have to generate new ones/not worry about renewing existing ones? By default GetSSL would copy and use your current cert, until it was due for renewal - although you could just create new certs if you wanted to. > [@Byu](#): > > Does certbot support DNS validation or I have to use GetSSL? Certbot doesn't currently support the DNS challenge, although it is planned soon. There are a number of [alternate clients](https://letsencrypt.org/docs/client-options/) that support the DNS challenge ( certainly all the Bash and Go ones ) > [@Byu](#): > > By the way, when the certificate file is updated (and path to cert file doesn't change), do I have to restart Apache server You need to either restart or reload apache (I prefer reload, as it doesn't affect existing connections ). ---
**Author:** ![Byu](https://avatars.discourse-cdn.com/v4/letter/b/9fc29f/32.png) [@Byu](https://community.letsencrypt.org/u/Byu)\ **Post date:** [September 18, 2016, 12:02pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/6 "2016-09-18T12:02:36Z")
I got everything set up. Thank you for all your help. GetSSL was exactly what I wanted. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 18, 2016, 12:02pm UTC](https://community.letsencrypt.org/t/generate-certificate-on-local-machine/19945/7 "2016-10-18T12:02:52Z")
Closed on October 18, 2016, 12:02pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.