How should I handle HTTPS certificates when migrating a server?
The destination needs a valid certificate for the hostname before it serves production HTTPS. Decide whether to issue a new certificate or use an authorised transfer supported by your certificate process. Keep certificate renewal ownership and domain validation working after the move.
Before you start
- The hostname inventory, certificate authority process and access to the relevant DNS or HTTP validation route.
Instructions
1. Map every TLS endpoint
Identify certificates on the origin server, reverse proxy, load balancer and any other TLS termination point. Check names, expiry, trust chain and where private keys are held. A valid CDN-facing certificate does not establish that the origin’s separate certificate is valid.
2. Arrange pre-cutover validation
HTTP-based validation must reach the endpoint serving the challenge; DNS-based validation uses the required DNS record and can support issuance before the web address moves. Use the method supported by your certificate authority and client. Scope DNS credentials narrowly and protect them as secrets.
3. Test issuance and renewal responsibilities
Use the authority’s staging facilities for rehearsals where available and respect issuance limits. Test the new HTTPS endpoint with the real hostname, then verify the scheduled renewal and deployment process on the destination. Keep the old endpoint valid for its agreed overlap without creating competing renewal arrangements.
Check the result
- The destination serves the intended hostname with a valid trusted certificate.
- The responsible renewal process can validate and deploy certificates after cutover.
Troubleshooting
- Renewal still reaches the old server
- Check public A and AAAA records, challenge routing, proxy behaviour and the active renewal client. Update the defined validation path rather than repeatedly requesting certificates.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.