Migrating to new server

Help
1

My domain is: guideastuces.com

I need to move it to a new server (Debian 8.11) keeping the same domain name and all existing URLs.

The website is set up properly on the new server, but before pointing the Domain name I have to set up the certificate.

I tried to create new certificate on the new server (via PLESK 18) but without success.

Here are the details of the error:

Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/3649241122.

Details:

Type: urn:ietf:params:acme:error:connection

Status: 400

Detail: Fetching https://guideastuces.com/.well-known/acme-challenge/46cTvzzcIucP0YNA6UggnbW4xl6q85uS6TOiJKAUkmQ: Timeout during connect (likely firewall problem)

Capture d’écran 2020-03-30 à 09.33.26
Capture d’écran 2020-03-30 à 09.33.26894×566 73.9 KB

May be, I have to move my current certificate to the new server. If so can you show me how to do this ?

My hosting provider, if applicable, is: OVH

I can login to a root shell on my machine : Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): PLESK

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): I don't know

2

can this help you?

https://support.plesk.com/hc/en-us/articles/360002205273-How-to-download-an-SSL-certificate-in-Plesk

you need fullchain and key.

alternatives include: switching the dns/ip and make new certs, using the dns-01 challenge instead. (does plesk support it?)

3

Thank you for the link, but I don’t have Plesk in the old server.

About the 2nd option, can you explain please? This is the first time i do this :confused:

4

how are you managing certificates in the old server? you can import them into plesk, I think.

5

Manually via ssh terminal

6

What acme client did you use? certbot? then you’ll find the files you need in /etc/letsencrypt/live

7

Yes I have that folder :

Capture d’écran 2020-03-30 à 15.36.15

I go to Plesk->Add certificate but I don’t know witch files upload :

Capture d’écran 2020-03-30 à 15.40.14

8

*.key is key.pem

*.crt is fullchain.pem

and *-ca.crt you can omit it, if using fullchain. if you use cert.pem instead of fullchain, give chain.pem as the last file.

9

Ok I uploaded key.pem and fullchain.pem. Now I have following message :

Information: The SSL / TLS certificate has been added. For this to work, assign the certificate to secure a domain, email address, or webmail.

Capture d’écran 2020-03-30 à 15.59.37
Capture d’écran 2020-03-30 à 15.59.371010×506 63 KB

10

you should add both certificates, I think. then I don’t know what plesk is talking about, it’s probably how it works with certs.

11

:confused:
is there any other way to do this ? or generate a new certificate for example ?

12

You can try and get a wildcard certificate via the plesk interface. This will force plesk to use the dns challenge and you’ll be able to get a new cert without changing the A/AAAA records, but I don’t know if it will be able to renew automatically.

(I hate control panels)

13

I tried to get a wildcard certificate via Plesk, but it failed.

https://guideastuces.com/.well-known/acme-challenge/A7ZEr4yOD2KPWZIUJu9nHV0OWFZPc0EiY4CFwgiiSWM: Timeout during connect

It make sense, because A/AAAA record of guideastuces.com point to the old server. Of course, I shouldn't change it before I fix certificate on the new server.

14

it doesn't, wildcard certificates don't use A/AAAA records, only TXT ones. But plesk might be stupid enough to use dns-01 for *.example.com and http-01 for example.com (both are needed)

How much downtime are you comfortable with? Obtaining a certificate doesn't take a lot of time.

You can also obtain a certificate on the old server and upload it on the new one. Make sure to get all domains you need on one certificate (certbot certonly --cert-name newserver -d example.com -d www.example.com -d other.example.com)

15

Up to 3 hours.

I will try this option.

16

then you can switch dns records and get certs on the new server (use short ttl in case you have to go back)

17

In the end, it was an IPv6 address problem. I removed the AAAA records in the old server and the problem is gone.
Thank you, I really appreciate your help :slight_smile:

18

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.