Moving and merging certs from Server A to B

Server
4

This is an interesting question and is something the client team should think more about in the future.

What you should do here is copy over the /etc/letsencrypt/archive, /etc/letsencrypt/live, and /etc/letsencrypt/renewal directories, taking care to preserve the symlinks in /etc/letsencrypt/live during copying.

The files in the /etc/letsencrypt/csr and /etc/letsencrypt/keys are simply named ####_csr-certbot.pem and ####_key-certbot.pem respectively, where #### is an increasing counter. This will create a conflict when trying to merge the files with another /etc/letsencrypt directory.

I wouldn’t worry about copying the other files into /etc/letsencrypt on the other server. You might want to make a backup of the files somewhere, but you won’t need them to move the site to the other server. If you’re curious, the other files in /etc/letsencrypt are:

  • /etc/letsencrypt/accounts contains ACME registration information. Certbot currently doesn’t have great support for multiple ACME accounts and for the protocol as is, it doesn’t matter. This is something you should at the very least keep a backup of though.
  • /etc/letsencrypt/csr contains the CSR we used to get your cert.
  • /etc/letsencrypt/keys contains the private key we generated for your new certificate. Another copy of this is also found in /etc/letsencrypt/archive which you should copy over.
6 Likes