The certs are just files so use any secure file transfer method you prefer. I would copy all the files even if you do not use all of them today - cert.pem, chain.pem, fullchain.pem, and privkey.pem
Another way is to have one server manage (issue, renew) the certs and store them in a secure secrets location. Then, all your other (1000) servers can get them from there when they start up and periodically like daily.
For all methods, make sure the file transfer is secure so you do not expose your private key to outsiders.
@joob I know little about your infrastructure so difficult to comment on general server admin. And, even if I did know that it is beyond the scope of this forum. There are many places to learn different strategies for large scale server admin.
Yes, make sure the set of cert files copy cleanly before using. Numerous ways to do this.
Everything ok, this is my first time writing here and I didn't want to annoy anyone.
I don't think I understood your suggestion.
If I do it the way Mike suggests, I will have the wildcard certificate and it will always be the same on all servers.
If I understand you correctly, you are saying that I should run a CertBot on each server and use a separate certificate there.
I can see that I have a lot of problems with my plan that I haven't solved yet. I also create dependencies and possibly a security problem for all servers if the PrivateKey falls into the wrong hands.
Did I understand you correctly and you suggest not applying for a wildcard certificate, but a separate one for each subdomain. In that context, I've heard that there are restrictions there that could cause me problems.
I'm saying that if you are able to get a wildcard cert (on server A), then you can repeat that exact same setup and get another similar wildcard (on server X).
Where A and X never have to speak with one another (about certs).
All servers will need both parts of their certs (public and private) to encrypt and decrypt.
So, there isn't a (simple) way to NOT have a private key and decrypt.
If you use the same exact cert on all servers, then they will all have the same private key.
If you generate individual certs, then they have different private keys.
well if they all have certificate that cover all the domains it doesn't really matter if which one is compromised. - they will have certificate for *.domain.com
want to operate many other servers (1000) with the certificate,
Sounds like OP want to have 1000s of servers with same certificate? I'd ask if it really need wildcard for all of that servers or he want to share certificate because got hit by 50 certs per base domain limit:- maybe rate limit increase is what should be done?
make a CSRand do a key deploy one time and keep that key for certificate renewals with --csr option? (does LE care about lifetime or expiration of CSR?) now certificate is public so you can just post it on github or something
I have a Java program that runs on the customer servers and uses a header server for various functions.
The header is responsible for the data exchange between the customer servers and for verification. When exchanging data, various data are exchanged, but usually files (multimedia, zips ...) which are then processed in the customer system. The data that are exchanged are stored on the customer's own server until they are released and are downloaded from the customer's server when requested, directly to the requesting customer's server.
The customers only work on your server.
I wanted to simplify the construction so that all servers have the same domain and only the subdomain changes. Hence the wildcard certificate.
In this context, of course, I have to plan something that is not subject to any restrictions with regard to the customer servers.