Transfer single TLS website between two servers

But don't you want both server IPs to respond properly to any https request while your DNS propagates? So, you need certs and server conf on both servers during the transition.

You could just copy over the two cert files (fullchain and privkey) from old server to a temp location in your new server and setup your new server conf to use those two until your old server no longer responds to any requests. You can test connections at new server before DNS change using openssl to connect to IP directly with -servername option (if openssl 1.1 or later)

Once new server is only active one setup a proper cert request / renew on the new server and update its conf to use these new certs. The last step is to delete the certs and conf from the old server (if that is necessary).

This can be done slowly step-by-step without risking connections to existing server.

Aside: If you control your DNS you could set TTL to very short value now and wait for old TTL value to expire before changing the IP. This minimizes window. Set TTL back after new site proven. But, above is viable anyway and seems less risky than a "hot swap".

3 Likes