Howto move existing certificates to different new servers?

Help
1

I run multiple services on a single server. Now I'm building different servers and distributing the services on them. I get eight different certificates from LE on the old server, some with multiple names (SAN). I would like to know what is the appropriate procedure for distributing these certificates to the new servers and for the time being still being able to leave them installed and also be able to renew them on the old server.

  1. I could copy the /etc/letsencrypt/live directory to the appropriate new server depending on the service. What is not clear to me with this procedure is how I can then have these certificates renewed on the new server.

  2. The other variant is to obtain the required certificates on each server again. With this procedure, it is not clear to me what happens to the previous certificates and whether they can still be renewed on the old server afterwards. Because it takes a certain amount of time between the installation and the commissioning of the new server, during which the certificates should be installed on both the old system and the new one.

And how do I say at the end that I no longer need the certificates on the old server? Does LE have to know that?

2

Script some sort of task (rsync would seem a likely candidate) to keep /etc/letsencrypt/ in sync across all the hosts, and call that as a renew-hook as part of your renewal process.

Nothing at all happens to them; they're still there and can still be used and renewed, as long as both the old and the new servers can satisfy the challenge.

3 Likes
3

[/quote]
Nothing at all happens to them; they're still there and can still be used and renewed, as long as both the old and the new servers can satisfy the challenge.
[/quote]

Aha, that means I can get the same certificate from multiple servers? I didn't know that and I think that makes things very easy.

4

Yes--as long as each server can satisfy the challenge.

4 Likes
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.