Migrating an SSL Certificate to a New Server or Reissuing It

When migrating to a new server, an SSL certificate must either be migrated (if you purchased it) or reissued (if you used Let's Encrypt). In most cases it's simpler and faster to issue a new free Let's Encrypt certificate — this takes 2–5 minutes.

When to Migrate and When to Reissue

Option 1: Let's Encrypt on the New Server (Recommended)

# Install Certbot
apt install certbot python3-certbot-nginx -y

# Issue a certificate for the domain
# (DNS must already point to the new server!)
certbot --nginx -d example.com -d www.example.com

# Or in standalone mode (before configuring Nginx)
certbot certonly --standalone -d example.com -d www.example.com

# Auto-renewal — certbot sets up the timer automatically
systemctl status certbot.timer

Option 2: Migrating a Paid SSL Certificate

Exporting from cPanel

># cPanel → SSL/TLS → Manage SSL Sites
# Copy three files:
# - Certificate (CRT)
# - Private Key (KEY)
# - CA Bundle (Chain)

Installing on Nginx

># Save the files on the new server
# /etc/ssl/example.com.crt  ← Certificate + CA Bundle (merge them!)
# /etc/ssl/example.com.key  ← Private Key

cat example.com.crt ca-bundle.crt > /etc/ssl/example.com-fullchain.crt

# Nginx config
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/ssl/example.com-fullchain.crt;
    ssl_certificate_key /etc/ssl/example.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
}

nginx -t && systemctl reload nginx

Installing on Apache

># /etc/apache2/sites-available/example.com-ssl.conf
<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/example.com.crt
    SSLCertificateKeyFile /etc/ssl/example.com.key
    SSLCertificateChainFile /etc/ssl/ca-bundle.crt
</VirtualHost>

a2enmod ssl
a2ensite example.com-ssl
systemctl reload apache2

Verifying SSL After Migration

># Check the expiration date and trust chain
openssl s_client -connect example.com:443 -servername example.com < /dev/null

# Check online
# https://www.ssllabs.com/ssltest/analyze.html?d=example.com

>curl -vI --resolve example.com:443:NEW-SERVER-IP https://example.com/ 2>&1 | grep -E "SSL|certificate"

Common Errors When Migrating SSL

Let's Encrypt vs a Paid Certificate When Migrating

When a Simple Reissue Isn't Enough

• An EV or OV certificate with a verified organization — you'll have to redo the company verification, and that isn't instant
• The client requires a certificate from a specific certificate authority under an internal security policy
• DNS hasn't switched to the new server yet and downtime isn't acceptable — use the SNI test described above first, then switch DNS
• A mobile app uses certificate pinning — changing the certificate without updating the app will break the connection

If migrating SSL is just one part of a larger project migration to a new server, start with the overall plan in how to switch to ZevsHost, and after the move use the post-migration verification checklist so you don't miss related settings beyond the certificate itself.

What Happens to HSTS When You Change the Certificate

If the old server had the Strict-Transport-Security (HSTS) header enabled, some visitors' browsers will remember that rule for weeks or months and refuse to load the site over HTTP even on the new server, until valid HTTPS is in place. That means the window between switching DNS and having SSL fully ready on the new server must be zero: the certificate needs to be issued and verified in advance using the SNI test described above, before you change the domain's A record.