New certificate provider, updating existing certificates?

Unfortunately, we've had to switch to a new certificate supplier, and I have about 100 certificates that were originally issued using certbot with our previous provider.

Is there a way to configure these so they automatically renew with the new supplier upon expiry? Or will I need to manually reissue each certificate as they approach expiration to transition them to the new provider?

not sure if it will work as it's just theory-crafting and I never tried it, but how about first register account and edit cronjob to add --server 'new ca here' option to certbot renew?

1 Like

I wouldn't update the cronjob for that.

Just try running certbot renew --server https://url.to.new.server.example.com/directory manually once.

And before that indeed run certbot register --server https://url.to.new.server.example.com/directory.

1 Like

I was not sure that change config for cert not renewed yet so I gone to safe side

1 Like

Good point. This is one of the few situations where --force-renewal is actually warranted.

2 Likes

Batch updating the CA would be a good standard feature for ACME clients to have because sometimes there might be a good reason to have to switch CA. In Certify The Web (which I develop) you can have multiple CA accounts and nominate a current preferred CA, with fallback to others if orders start to have problems.

3 Likes

Not every acme client is built with the expectation the user will have more than one acme account. I'd say most aren't.

2 Likes

Certbot can perfectly handle multiple servers and thus multiple accounts (just a single account per server though). It only does not out of the box support easy transition from one CA to another for the same certificate "lineage". Although I guess running Certbot with --server and --force-renewal should be easy enough :man_shrugging: It's not automated though, that's for sure.

2 Likes

Clients have two possible behaviours when doing that, they can replace the certificate or get a separate one

You can usually replace the certificate, but not every client lets you keep both. Certbot saves certificates by --cert-name, acme.sh and lego by domain name, caddy by acme account and domain name, etc...

2 Likes

Yeah, it's kinda an ACME client minefield out there :roll_eyes:

2 Likes

For Certbot, the renewal configurations are all filebased BUT the format is undocumented and not necessarily the same as commandline options. See
Where is the renewal config file grammar documented? - #2 by _az

Linked from there, was another issue that eventually linked to this improvement on updating configurations: Option to update renewal configuration · Issue #5828 · certbot/certbot · GitHub

And that change did land, as we see here with the reconfigure command
https://eff-certbot.readthedocs.io/en/latest/using.html#modifying-the-renewal-configuration-of-existing-certificates

Unfortunately, changing the server or account does not look to be currently supported.

If I were you, I would try this:

  1. Archive the entire Certbot installation for safety into a tar file
  2. Obtain a dummy cert from your intended server
  3. Write a script to iterate through all the renewal files and change the following 2 lines to mimic the lines for the dummy cert:
    • account
    • server

I agree with all this. Hoping to release the new version of my client with similar features soon.

4 Likes