1

I have been tasked with transferring SSL certificates from one server to another for a website. I know nothing about this but have been reading that if everything is the same on the 2 servers then I should be able to just copy some files. Otherwise I have regenerate something.

The original server is CentOs machine running apache that has several websites on it. The new server is a CentOs VM also running apache on a different machine. The website has the whole new VM to themselves, they dont share with anyone else. So one thing that is different is the location of their html files. On the old machine their website is under their username and on the new VM they are directly under /var/www/html. Is that something that will make a difference when transferring these certificate files?

Does each site have its own SSL certificate or does the server have one that covers all the sites on it? If so, if I copy the files to a new machine, will it somehow mess up the SSL for the other sites on the old machine?

2 Answers 2

0

That depends whether or not it is a UCC cert. The best way to determine is to look in your Apache config for "SSLCertificateFile" and see if it points to the same cert.

If it does not, they have separate certs - and most likely also separate IP addresses. That would be a requirement on the VM as well, and the config would need to be altered to reflect this.

8
  • If you keep ALL config in httpd.conf yes. Otherwise no. some config can be in conf.d or in sub directories. Also, cat and then grep is spawning an unnecessary process, you can do "grep SSLCertifiateFile /etc/httpd/conf/httpd.conf" Jan 2, 2012 at 5:03
  • Thanks for the info. I checked the other places. "grep SSLCertifiateFile /etc/httpd/conf/httpd.conf" is the only place gives a list of that includes a line for each site : SSLCertificateFile /usr/share/ssl/certs/website.com.crt. Do you think I cna copy that over the the new VM and put it in the same place? Or are there additional factors?
    – karmet
    Jan 2, 2012 at 5:39
  • I copied /usr/share/ssl/certs/website.com.cr* from the old machine to /etc/httpd/conf/ on the new machine. Do you think that will work? How would I go about confirming that it did or didnt? thanks for the help
    – karmet
    Jan 2, 2012 at 6:39
  • You need more than just the certificate files. You also need the private keys. Look after SSLCertificateKeyFile - Generally, migrating like this isn't just something you do like that. If I were you, I would get in touch with a consultant to help you. A good *nix admin could do this in like an hour. (I say an hour because very often something unexpected shows up during the process) Jan 2, 2012 at 8:48
  • unfortunately I am the admin here =(
    – karmet
    Jan 2, 2012 at 10:19
0

Here is what worked for me: Look at the SSL config file to determine the location of the SSLCertificateFile and SSLCertificateKeyFile

nano /etc/httpd/conf.d/ssl.conf

The certificate may well be dependent on an intermediary file (.crt) which will likely be in the same directory. Copy all (private) .key file and the crt file(s) to the same location on the second server.

Ensur the permissions on the copied files match those on the original server

Update SSLCertificateFile and SSLCertificateKeyFile in ssl.conf to match the original server

test apache config

/usr/sbin/apachectl configtest

restart apache

/usr/sbin/apachectl graceful
1
  • Another down vote without any hint as to how the answer could be improved, is this really the way to encourage other people to help each other out? Jan 31, 2019 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.