Migrating sites: issue LetsEncrypt certificate for site ______

MattShepherd

I'm tiptoeing into moving some of my simpler sites (just html/css) to OpalStack, and walking through the site creation steps this morning, I've run into this error: Unable to issue LetsEncrypt certificate for site LeafKingston because it has external DNS and external A/AAAA records.
Which is currently true -- the DNS for the site is pointing to the live account at WebFaction, via my registrar, and WebFaction is generating the LetsEncrypt certificates.
How do I proceed with the site transfer while minimizing the amount of time that https isn't active? I'm not well versed in certificates, so I'm not sure if I should be attempting to move one around, or...

sean

You won't be able to generate a new LE cert on our end if all of the DNS stuff is still pointing at your old host. What you can do instead is:

Get a copy of your current LE certificate and its matching key from WF.
Add the domain to your Opalstack dashboard.
Add the certificate to your Opalstack dashboard. (https://help.opalstack.com/article/33/managing-ssl-certificates#adding-a-certificate)
Set up the site in your Opalstack dashboard with the certificate you added. Don't check the LE option, just select your certificate from the list.
When you're ready, point your DNS at Opalstack.
After DNS has propagated you can turn on the LE option for the site and we'll manage it automatically from that point forward.

MattShepherd

sean Thanks, Sean! Should I still leave the "have Opalstack generate certificates" set to on so it will generate as old certificates expire?

sean

MattShepherd No. You should leave the automatic LE toggle turned off until you've either pointed your domain at us.

seandavey

if our LE certs have recently been renewed at our old provider, say webfaction, do we need to wait before having opalstack get us new LE certs? or can we do it as soon as we point the DNS records to our opalstack server?

sean

seandavey if our LE certs have recently been renewed at our old provider, say webfaction, do we need to wait before having opalstack get us new LE certs? or can we do it as soon as we point the DNS records to our opalstack server?

No, you don't have to wait for your cert to expire at WF. We'll issue a new one as soon as your NS changes have propagated.

For a smooth transition:

Get a copy of your current LE certificate and its matching key from WF.
Add the domain to your Opalstack dashboard.
Add the certificate to your Opalstack dashboard. (https://help.opalstack.com/article/33/managing-ssl-certificates#adding-a-certificate)
Set up the site in your Opalstack dashboard with the certificate you added. Don't check the LE option, just select your certificate from the list.
When you're ready, point your DNS at Opalstack.
After DNS has propagated you can turn on the LE option for the site and we'll manage it automatically from that point forward.

seandavey the cert files from webfaction have two sets of those lines, i.e. two certificates, in them. should I paste in the entire contents of the file?

Yes, you can paste all of that into the certificate field.

seandavey

also, I notice that when adding a cert in opalstack it says Certificates will have the words 'BEGIN CERTIFICATE' on the first line, and 'END CERTIFICATE' on the last line. but the cert files from webfaction have two sets of those lines, i.e. two certificates, in them. should I paste in the entire contents of the file?
(edit)
I've been informed that the intermediate certs are included in the webfaction cert file. Do I need to split these out for the opalstack form? if so, do you think the main one comes first or last in the file?

aa11

sean
Get a copy of your current LE certificate and its matching key from WF.
Add the domain to your Opalstack dashboard.

(Probably dumb questions ahead. Beware ☠)

As mentioned in some of the posts here, I've been using rsync to migrate non-app files WF -> OS.

It works great.

But I always receive permission warnings on the ~/certificates dir. Which, from what I can tell, holds all of the current and expired LE certificates. It's because the files are owned by root and my user doesn't have read permissions (they're 640).

It looks like:

Current .cert and .key can be read (because: They're owned by the user, not root)
Older (expired?) .key files can't be read (because: They're owned by root)

❔ I don't think that should be a problem, right?

❔ Is it important, at all, to keep a backup (i.e.: record keeping) of the readable contents of this directory?

Thanks.

sean

aa11 We don't do anything with ~/certificates on Opalstack.

If you plan to use your certificates that you've copied over then you'll need the keys. Ask WF to make a copy of the directory and chown it all over to you.

If you don't plan to use them then you don't need any of it. Personally I don't have any need to keep my own old certs around.