I'm about to move my server from a 32bit ubuntu 18.04 LTS to a 22.04 (64bit). I'm currently preparing the new machine and install all packages.
The new machine will have a different IP, of course, but will retain the host/domainname. Can I just take all certificates with me to the new machine on day X, when I switch DNS to the new hardware and IP?
yes you can but you should set certificate renewal on new machine afterward as it won't renew automatically after that
Yes, this is possible. Let's Encrypt certificates aren't "bound" to an IP address, as Let's Encrypt currently only issues certificates for hostnames. So as long as the hostname(s) are the same, there shouldn't be any issue.
Note that depending on the ACME client used, there might be certain things you need to consider. E.g. for Certbot, you can simply transfer the entire /etc/letsencrypt/ directory over from the old to the new machine. But you need to make sure symbolic links are preserved when doing so.
You can, but if you're not talking about massive numbers it's easier and a lot less error prone to issue new certificates on the new machine. Just make sure the webserver can start.
Easier than tar -czf mycerts.tar.gz /etc/letsencrypt? 
I see no reason to set up everything again. When running as root, tar will preserve everything, including file modes and symlinks.
That depends on your way of installation. When using pip (which I personally prefer) you will have to set it up yourself, but most distribution packages will come with preconfigured cronjobs or timers.
You can do that, sure. I wouldn't recommend it for a few certs.
Also, Certbot usually isn't forwards-compatible, so make sure the version on the new machine is newer or the same.
You'll get a warning when downgrading, but I don't think there are widely-used features in the renewal config file that won't work with a 1-2 year older Certbot. Maybe key_type is a good counterexample, if people are using that and going further back in Certbot release history (it's supported since December 2020).
I was thinking the same thing: there's almost nothing really important for forward-compatibility, e.g. must_staple is around since 0.7.0. But then I indeed thought of key_type.. And seeing that sometimes people use snap (e.g.: 2.6.0) on a system packaging 0.40.0 by the distro itself.. That could lead to some unwanted things if one used to use snap, but suddenly forgot about snaps existence and went back to using the distro package.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.