5

my domain example.com is currently pointing to a server with an alphassl certificate. I want to point this domain to my new server (by changing the nameservers) without any timeout of https. So I want to install the let's encrypt ssl certificate for example.com on the new server before. Is this possible? How?

6

Yes, it should actually be quite easy to do what you're asking. You can certainly have different SSL certificates issues for the same domain, from different Certificate Authorities. The fact that you are also spinning up a new server makes it especially easy.

Here's the workflow:

  1. Move your existing server certificates and keys to the new server.
  2. Test the new server by associating its IP address with your domain in the hosts file on a local laptop or desktop, and visiting the site.
  3. When you're ready to switch, point your DNS records to the new server. As the new DNS records propagate, some clients will begin to use your new server. Logged-in clients will need to re-authenticate the first time they connect to the new server, as it won't have their session information from their connections to the old server. This should only happen once.
  4. Wait sufficient time for the DNS changes to propagate throughout the Internet. 2 days is probably the minimum; a month or more should ensure that any cached DNS entries will likely have expired on all clients.
  5. Meanwhile, request new certificates for your domain from Let's Encrypt on the new server. If that works, replace the existing certificates and keys on the new server.
  6. Check the old server's logs to verify it is no longer being used to serve client requests.
  7. Deprovision the old server.

I'd recommend configuring the Lets' Encrypt client to only request the new certificates, and then install them yourself. That way there is less of a change for failure. Alternately, test the certificate issuance and installation process on the new server before it is in production use by requesting certs for a subdomain or second domain that you can point at the new server.

If requiring clients to re-authenticate once is truly unacceptable, there might be a way of copying over session data from the old server to the new one. That would require some further research, and depends on how your web application(s) store session information.

  • 1
    Hi thanks. But how can I request a new certificate on the new server from let's Encrypt when the server IP is not visible in the A records of the DNS? That's actually the problem! – AndiPower Aug 11 '16 at 15:02
  • 2
    You can request the certificates on the existing server and transfer them over to the new server. Alternately, use a tool like letsencrypt.sh to request certificates from Let's Encrypt using the DNS-01 challenge. – hampercm Aug 11 '16 at 15:08
  • Unfortunately the hoster doesn't allow to request letsencrypt cerificates on my old server (managed server.). Can you please explain option 2 a bit or do you have link to a tutorial? – AndiPower Aug 11 '16 at 15:31
  • 3
    @AndiPower Why don't you just use the existing certificates on the new server for now, and then you can install Let's Encrypt later. – Michael Hampton Aug 11 '16 at 17:05
  • Very good point, @MichaelHampton; why didn't I think of that ;) I've updated my answer to follow your suggestion. – hampercm Aug 11 '16 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.