How to Move or Copy SSL Certificates from One Server to Another?

Because of reasons like – change in hosting provider, load balancing, scaling, etc.,  you may be required to move or copy SSL certificates from one server to another. However, doing so can be troublesome – if you are unaware of the steps involved in the migration process.

If you are facing issues while migrating the cert or don’t know how to do that – don’t worry. In this article, we will explain – the standard process to migrate your SSL certificate from one server to another.

To help you better understand, we will also explore a step-by-step procedure that needs to be followed to move or copy SSL certificates from a Windows Server to another Windows Server.

So, why wait – Let’s start!

Standard Process to Migrate your SSL Certificate from One Server to Another

From a high-level perspective, irrespective of the servers involved, you can migrate your SSL cert using a simple process comprising of these three steps:

1. Export SSL and chain certificates, along with private keys from its current server
2. Convert the SSL certificate format to meet the server’s requirement on which you will install that cert, if required.
3. Import the SSL Certificate on your new server.

How to Move or Copy an SSL Certificate From a Windows Server to Another Windows Server

Follow the steps mentioned below to accomplish the same:

Export the Certificate From the Current Windows Server

• Click on Search, placed on the taskbar.
• Type IIS and press Enter.
• The Internet Information Services (IIS) Manager window will appear.
• Select the server on which the SSL cert is installed.
• Click Server Certificates.
• Right-click on the SSL certificate that you want to export.
• From the list, select Export.
• In the Export Certificate box, perform the following actions:
  • In the Export to box, enter the location where your certificate will be exported.
  • In the Password box, type the password.
  • In the Confirm Password box, type the same password again.
  • Click OK.

Convert the SSL Certificate

There is no need to convert the certificate’s format as you are exporting the cert from a Windows server and installing it on another Windows server; hence, changing its format is unnecessary.

Import the Certificate on the New Windows Server

• Click on Search, placed on the taskbar.
• Type IIS and press Enter.
• The Internet Information Services (IIS) Manager window will appear.
• Under the Actions tab, click Import.
• The Import Certificate dialog box will open.
• In the Import Certificate box, perform the following actions:
  • In the Certificate file (.pfx) box, enter the location where the exported SSL cert is stored.
  • In the Password box, type the password you entered while exporting the certificate.
  • Click OK.

With this steps, you have successfully moved or copied an SSL certificate from a Windows Server to another Windows Server. All that’s left is to bind the imported cert to a specific website.

How to Move or Copy an SSL Certificate From a Windows Server to an Apache Server?

Follow the steps mentioned below to move or copy an SSL cert from a Windows server to an Apache server:

Export the SSL Certificate and Private Key

1. On your keyboard, simultaneously press the Windows + R buttons.
2. Type in MMC and click OK.
3. From the File list, click Add/Remove Snap-in.
4. Click on Computer Account and then click Next.
5. Leave Local Computer selected.
6. Click Finish.
7. In the left pane, click plus (+) placed adjacent to Certificates.
8. Click the plus icon adjacent to the Personal folder.
9.  Click on the Certificates folder.
10. Right-click on the SSL cert you want to export.
11. Select All Tasks, and from the list, click Export.
12. In the Certificate Export Wizard, click Next.
13. Click Yes, export the private key.
14. Click Next.
15. Click the checkbox adjacent to Include all certificates in the certification path if possible.
16. Click Next.
17. Type and confirm the password. (The password will be required to import the cert onto a different server.)
18. Click Browse and save the .pfx file to the desired location.
19. Type in a name such as mysslcert.pfx.
20. Click Next.
21. Click Finish.

Convert the SSL Certificate

Utilize the OpenSSL cmd mentioned below to create a text file containing the contents of the .pfx file:

openssl pkcs12 -in mysslcert.pfx -out mysslcert.txt -nodes

Open a text editor (Notepad), and copy the Primary and Intermediate SSL Certificate and Private key to its own text file, including the “—–BEGIN PRIVATE KEY—– and –—-END PRIVATE KEY—–” tags. Save them with names like – mysslcert.key, mysslcert.crt, etc.

Configure the Apache Server

Before configuring the Apache server, transfer the certificate and key files to the server. To do this, use the SFTP or SCP client to upload the files to the server’s secure location (/etc/ssl directory). Also, ensure the certificate and key files have valid permissions on the Apache server, or it will not be able to read the files.

Follow the steps mentioned below to configure Apache Server:

• Add these directives in the Apache Configuration file:
  • SSLCertificateFile /path/to/certificate.crt
  • SSLCertificateKeyFile /path/to/private.key
• Restart the server. (You can utilize – the “systemctl restart apache2” command to do so.)

Note: Replace the actual file paths for the certificate and key files on the Apache server.

With this – you have successfully moved or copied an SSL certificate from a Windows Server to an Apache Server.

How to Move or Copy an SSL Certificate From an Apache Server to a Windows Server?

Follow the steps mentioned below to move or copy an SSL cert from an Apache server to a Windows server:

Export the SSL certificate and Private Key

To export the SSL certificate and private key from the Apache server, use the below-mentioned command:

sudo openssl pkcs12 -Export -out certificate.pfx -inkey private.key -in certificate.crt

Note: This will export the SSL certificate and convert it to .PFX. Copy the .pfx file to the Windows server using a secure method such as SFTP or SCP. Use the Microsoft Management Console and the Certificates snap-in on a Windows server to install the .pfx file.

Configure the Server

1. Click Search, type IIS Manager, and press Enter.
2. The IIS Manager window will appear.
3. Click on the website that you want to secure with SSL.
4. In the right pane, under the Actions section, click Bindings.
5. Click Add.
6. The Add Site Binding window will appear.
7. From the Type list, select https.
8. Select the SSL certificate that you imported in the previous step in the SSL certificate dropdown.
9. Click OK.

With this – you have successfully moved or copied an SSL certificate from an Apache Server to a Windows Server.

How to Move or Copy an SSL Certificate From Tomcat/Java Server to OpenSSL?

Follow the steps mentioned below to move or copy an SSL cert from a Tomcat/Java Server to OpenSSL:

Export the SSL Certificate and Private Key

To export SSL certificate files, use the below-mentioned command:

keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -destkeystore certificate.p12 -deststoretype PKCS12

Note: This will export the SSL certificate and convert it to .p12 file. Copy the .p12 file to the OpenSSL server. You can use a secure method such as SFTP or SCP to transfer the file from the Tomcat server to the OpenSSL server.

Convert the .p12 file to Separate Certificate and Key Files

To convert .p12 to .txt, use the below-mentioned command:

openssl pkcs12 -in certificate.p12 -out certificate.txt -nodes

Install the SSL Certificate

• Open .txt file using a text editor (For ex – Notepad).
• Copy the data to separate certificate and key files.
• Place the certificate and key files in the appropriate locations.
• Edit the OpenSSL configuration file to specify their locations.
• Enable SSL for the site that you want to secure.

With this – you have successfully moved or copied an SSL certificate from a Tomcat/Java Server to OpenSSL.

Conclusion

In today’s era, where multiple organizations use Multi-domain or Wildcard SSL certs to secure multiple domains or sub-domains using a single certificate – you may find the migration of SSL certificates as an everyday activity. The process is straightforward and involves three steps- Export, Convert (if needed), and Import.