Changing hosting providers or moving a site to a new server is mostly about files, databases and DNS, and the certificate tends to be remembered at the last minute. Then the DNS switch happens and visitors see a certificate warning, or everything looks fine until renewal quietly fails a few weeks later because the new server was never set up to renew. Knowing how to move an SSL certificate to a new server, and whether to move it at all, keeps HTTPS working through the cutover.

Two ways to move an SSL certificate to a new server

There are two options, and for most sites the first is simpler.

  • Issue a new certificate on the new server. With an ACME certificate authority such as Let's Encrypt, the new server requests its own certificate and sets up its own renewal. Nothing is copied, and the old server's certificate simply expires.
  • Transfer an SSL certificate you already have. This is the route for a paid certificate with time left on it, or when the new server has to serve HTTPS before it can validate the domain. You need three pieces: the certificate, the intermediate chain and the private key that belongs to them.

A certificate is tied to domain names, not to a server or a hosting company, so an SSL certificate after changing hosting is still valid as long as its private key comes along. Without the key the certificate is useless, and that is where most transfers go wrong: the key stayed behind on a server that has already been cancelled. Most commercial certificate authorities let you reissue with a new key during the validity period, so check your CA's terms if the old key is gone.

Handling the private key

Copy the key over SSH or SFTP, never by email or chat, and keep it readable only by root and the web server. On Windows servers the certificate and key usually travel together in a password-protected PFX file, which can be exported only if the key was marked exportable when the certificate was installed.

The cutover problem: validating before DNS moves

ACME's HTTP-01 challenge proves control of a domain by fetching a file over port 80 from whatever server the domain currently points at. Before the DNS switch that is still the old server, so the new one cannot get a certificate that way. There are three clean solutions:

  • DNS-01 validation. The client proves control by creating a TXT record, which works no matter where the site is hosted. Automated renewal then needs API access to your DNS provider, and it is the only way to get a wildcard certificate from Let's Encrypt.
  • Redirect the challenge path. Let's Encrypt's HTTP-01 check follows redirects, so the old server can forward requests for /.well-known/acme-challenge/ to the new one during the transition. The challenge types documentation lists the conditions.
  • Bridge with the existing certificate. Copy the current certificate and key to the new server for the first days, then switch to automatic issuance once DNS has moved.

Checklist before the DNS switch

  • List every hostname. The bare domain, www, shop or app subdomains, the mail host, the control panel address and any API endpoint. Every name the new server answers for must be on a certificate.
  • Lower the DNS TTL a day or two ahead, so the switch spreads quickly and can be reversed quickly.
  • Check the CAA record. A CAA record in DNS limits which certificate authorities may issue for the domain (RFC 8659). If the new host issues certificates through a different CA than the old one, issuance fails until the record allows it.
  • Test through a hosts-file entry. Point your own computer at the new server and load the site over HTTPS before anyone else does.
  • Serve the full certificate chain, not just the site certificate. Browsers often cope with a missing intermediate; payment gateways, API clients and older devices often do not.
  • Respect HSTS. If the old site sent an HSTS header, browsers that visited it will refuse plain HTTP and will not let visitors click past certificate errors. The new server must serve valid HTTPS from the first minute.
  • Keep redirects to one hop from any http or www variant to the final HTTPS address.

Mail, panels and the old server

Websites get the attention, but mail servers need valid certificates for SMTP and IMAP too, and a migrated mail host with a self-signed or mismatched certificate triggers warnings in every mail app. The same goes for a hosting panel's login page and for webhooks that payment or shipping providers send to your site: they call an HTTPS address and give up if the certificate does not validate.

When the move is done, delete the private keys from the old server and stop its renewal jobs, which will otherwise keep trying and failing. If the old host was compromised, or you no longer control it, revoke the old certificate and issue a new one with a new key. The rest of the move, from files to databases and mailboxes, is covered by our hosting and database migration service.

Confirm renewal on the new server

The last step prevents the next outage. Run a test renewal, for example certbot renew --dry-run with Certbot, confirm that the scheduled timer or cron job exists, and make sure a failed renewal raises an alert. Public certificates are now limited to at most 200 days and the limit keeps shrinking, as our guide to SSL certificates explains, so renewal runs several times a year and must not depend on anyone remembering. If you hire an SSL installation service or an SSL configuration service for the move, ask for this test to be part of the handover. In our SSL certificate installation work, renewal is set up and tested, with an alert if it ever fails.

Frequently asked questions: move an ssl certificate to a new server

Can the same SSL certificate run on two servers at once?

Yes. During a migration it is normal for the old and new servers to use the same certificate and key, and with automated certificates each server can also hold its own. Avoid requesting identical certificates in a loop while testing: Let's Encrypt allows five certificates for the exact same set of names every seven days, and its staging environment exists for experiments.

Do I need to buy a new certificate when I change hosting companies?

No, as long as you can bring the private key or your CA lets you reissue. Many hosts also issue automated certificates for the sites they host, in which case a paid certificate may not need renewing at all when it runs out.

Why does the site show a certificate error only on some devices after the move?

Usually the new server sends the site certificate without its intermediate chain, or the certificate lacks one of the hostnames people actually use, such as www. An external TLS checker shows both problems within a minute.

Moving a website, a mail server or a whole hosting account? Our SSL certificate installation and configuration service checks the current setup, installs and configures certificates on Apache, Nginx, HAProxy, hosting panels and mail servers, cleans up redirects and mixed content, and verifies the result, for clients in Long Beach and Los Angeles and remotely anywhere. Send us your domain name and the date of the planned move.