ML
    • Register
    • Login
    • Search
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups

    Looking to migrate Nginx and LetsEncrypt

    IT Discussion
    nginx centos fedora lets encrypt
    7
    19
    1006
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JaredBusch
      JaredBusch last edited by JaredBusch

      My Nginx reverse proxy server was setup on CentOS back in 2014. A couple years ago, I added LE.

      Everything runs great, but I am wanting to move it to Fedora.

      Moving Nginx is simple. I grab the config files from /etc/nginx/conf.d and done.

      But I am not sure how to move LE. Google results are mixed.
      I can, of course, just reissue certs. But that willleave me with a ton of expiring cert emails in about 60 days to just annoy the fuck out of me.

      Has anyone seen good instructions for this?

      DustinB3403 1 Reply Last reply Reply Quote 3
      • black3dynamite
        black3dynamite last edited by

        This looks promising.
        https://community.letsencrypt.org/t/moving-and-merging-certs-from-server-a-to-b/19015

        0_1531521499293_a59a539a-54e3-4827-80a1-71c20a1781c4-image.png

        JaredBusch 1 Reply Last reply Reply Quote 0
        • black3dynamite
          black3dynamite last edited by

          Could you temporary use Cloudflare SSL to avoid the expiring certs emails?

          JaredBusch 1 Reply Last reply Reply Quote 0
          • DustinB3403
            DustinB3403 @JaredBusch last edited by

            @jaredbusch said in Looking to migrate Nginx and LetsEncrypt:

            My Nginx reverse proxy server was setup on CentOS back in 2014. A couple years ago, I added LE.

            Everything runs great, but I am wanting to move it to Fedora.

            Moving Nginx is simple. I grab the config files from /etc/nginx/conf.d and done.

            But I am not sure how to move LE. Google results are mixed.
            I can, of course, just reissue certs. But that willleave me with a ton of expiring cert emails in about 60 days to just annoy the fuck out of me.

            Has anyone seen good instructions for this?

            Email filters do wonders for annoying as fuck emails. . .

            1 Reply Last reply Reply Quote 0
            • Obsolesce
              Obsolesce last edited by

              Why won't importing the existing certs to the new server work?

              JaredBusch 1 Reply Last reply Reply Quote 1
              • JaredBusch
                JaredBusch @Obsolesce last edited by JaredBusch

                @obsolesce said in Looking to migrate Nginx and LetsEncrypt:

                Why won't importing the existing certs to the new server work?

                I could easily copy the pem files over. but that doesn't do jack shit for the cert process.

                1 Reply Last reply Reply Quote 1
                • JaredBusch
                  JaredBusch @black3dynamite last edited by

                  @black3dynamite said in Looking to migrate Nginx and LetsEncrypt:

                  This looks promising.
                  https://community.letsencrypt.org/t/moving-and-merging-certs-from-server-a-to-b/19015

                  0_1531521499293_a59a539a-54e3-4827-80a1-71c20a1781c4-image.png

                  read that, but it seemed oddly unspecific coming from a dev. But, meh, it was the best thing I found.

                  Obsolesce 1 Reply Last reply Reply Quote 0
                  • JaredBusch
                    JaredBusch @black3dynamite last edited by

                    @black3dynamite said in Looking to migrate Nginx and LetsEncrypt:

                    Could you temporary use Cloudflare SSL to avoid the expiring certs emails?

                    No, because the emails come from LE.

                    stacksofplates 1 Reply Last reply Reply Quote 0
                    • Obsolesce
                      Obsolesce @JaredBusch last edited by

                      @jaredbusch said in Looking to migrate Nginx and LetsEncrypt:

                      @black3dynamite said in Looking to migrate Nginx and LetsEncrypt:

                      This looks promising.
                      https://community.letsencrypt.org/t/moving-and-merging-certs-from-server-a-to-b/19015

                      0_1531521499293_a59a539a-54e3-4827-80a1-71c20a1781c4-image.png

                      read that, but it seemed oddly unspecific coming from a dev. But, meh, it was the best thing I found.

                      That's nice, but was 2 years ago and still no actual "migration" method or documentation?

                      1 Reply Last reply Reply Quote 1
                      • B
                        bnrstnr last edited by

                        @JaredBusch Any update on this? What did you end up doing, if anything? Thanks

                        JaredBusch 1 Reply Last reply Reply Quote 0
                        • JaredBusch
                          JaredBusch @bnrstnr last edited by JaredBusch

                          @bnrstnr said in Looking to migrate Nginx and LetsEncrypt:

                          @JaredBusch Any update on this? What did you end up doing, if anything? Thanks

                          I did not get to it over the weekend due to a lack of Air Conditioning in our house. Ain't nobody got time for working in 95+ temperatures. I hope to get to it this weekend.

                          1 Reply Last reply Reply Quote 2
                          • momurda
                            momurda last edited by

                            Don't you have to update the certs every 3 months regardless? Don't you get the renewal 30 days before expiry regardless? Unless your current installed LE certs will never expire, what is the point of this? Delaying some bot generated emails a few days?

                            JaredBusch 1 Reply Last reply Reply Quote 0
                            • JaredBusch
                              JaredBusch @momurda last edited by

                              @momurda said in Looking to migrate Nginx and LetsEncrypt:

                              Don't you have to update the certs every 3 months regardless? Don't you get the renewal 30 days before expiry regardless? Unless your current installed LE certs will never expire, what is the point of this? Delaying some bot generated emails a few days?

                              Because I renew the certs daily with certbot.

                              It automatically renews at 30 days out. I never see renew emails.

                              1 Reply Last reply Reply Quote 1
                              • stacksofplates
                                stacksofplates @JaredBusch last edited by

                                @jaredbusch said in Looking to migrate Nginx and LetsEncrypt:

                                @black3dynamite said in Looking to migrate Nginx and LetsEncrypt:

                                Could you temporary use Cloudflare SSL to avoid the expiring certs emails?

                                No, because the emails come from LE.

                                I think he meant use the Cloudflare certs because they have multi year expiration.

                                1 Reply Last reply Reply Quote 0
                                • stacksofplates
                                  stacksofplates last edited by

                                  Oh wait. Do you mean that if you or then on a new server the emails will come because the old one is expiring? Or you just don't want new expiration notifications?

                                  1 Reply Last reply Reply Quote 0
                                  • stacksofplates
                                    stacksofplates last edited by

                                    If you start over with a new system so you still get notifications of old certs expiring? Aren't these handled at the domain level so it knows that a new system has a newer cert? Honestly asking since I haven't run into this yet.

                                    JaredBusch 1 Reply Last reply Reply Quote 0
                                    • JaredBusch
                                      JaredBusch @stacksofplates last edited by

                                      @stacksofplates said in Looking to migrate Nginx and LetsEncrypt:

                                      If you start over with a new system so you still get notifications of old certs expiring? Aren't these handled at the domain level so it knows that a new system has a newer cert? Honestly asking since I haven't run into this yet.

                                      No. It is handled on the cert serial number level.

                                      stacksofplates 1 Reply Last reply Reply Quote 0
                                      • stacksofplates
                                        stacksofplates @JaredBusch last edited by

                                        @jaredbusch said in Looking to migrate Nginx and LetsEncrypt:

                                        @stacksofplates said in Looking to migrate Nginx and LetsEncrypt:

                                        If you start over with a new system so you still get notifications of old certs expiring? Aren't these handled at the domain level so it knows that a new system has a newer cert? Honestly asking since I haven't run into this yet.

                                        No. It is handled on the cert serial number level.

                                        Ah ok.

                                        JaredBusch 1 Reply Last reply Reply Quote 0
                                        • JaredBusch
                                          JaredBusch @stacksofplates last edited by

                                          @stacksofplates said in Looking to migrate Nginx and LetsEncrypt:

                                          @jaredbusch said in Looking to migrate Nginx and LetsEncrypt:

                                          @stacksofplates said in Looking to migrate Nginx and LetsEncrypt:

                                          If you start over with a new system so you still get notifications of old certs expiring? Aren't these handled at the domain level so it knows that a new system has a newer cert? Honestly asking since I haven't run into this yet.

                                          No. It is handled on the cert serial number level.

                                          Ah ok.

                                          I've moved things in the past by simply reissuing on the new server, and dealing with the expiring certs is an annoyance.

                                          1 Reply Last reply Reply Quote 2
                                          • First post
                                            Last post