LetsEncrypt SSL - Additional Host

General Discussion
1

I currently have one host - host1.myDomain.com - this hosts several other domains (Virtual Servers) which all have SSL enabled and LetsEncrypt certs issues without any issues. The host runs Postfix and Dovecote among other things (MySQL, etc but no BIND).

The host (domain - myDomain.com) also has a cert - which Postfix uses.

I want to bring up another host - host2.myDomain.com and slowly move all the hosted domains across. I have a plan in mind. The question that springs to mind is:

I will be adding another A record for host2 in the 3rd Party DNS panel for host2 & it’s IP address first.

Looking on host1 & myDomain.com in Virtualmin (Server Configuration >> SSL Certificates >>Let’s Encrypt) , there are 3 entries listed in “Domain names listed here” field,

myDomain.com
www.myDomain.com
host1.myDomain.com

I would think that once Virtualmin is installed on the new host, it would have

myDomain.com
www.myDomain.com
host2.myDomain.com

Would that work - without messing up the existing cert on host1? If not - any advice?

Thanks

Dibs

2

Yes for host2.myDomain.com, no for myDomain.com while that domain is pointing to the IP address of the old server.

You wish to have *.myDomain.com on both servers so you must plan the migration well.

3

@calport

Many thanks for reply.

My thoughts are:

  1. I suppose if I only get a cert for host2.myDomain.com - that would allow me to get host2 up and running and accessible via URL. Adding the necessary A record at the external DNS.

  2. set an additional PTR record to point myDomain.com to the new IP address (assuming you can have 2).

  3. I actually have a new Virtual Server\Domain (mail enabled) to go live, so could test DKIM, etc with that and if all goes well - continue.

  4. Move the non mail enabled domains first, content etc. regenerating their SSL certs.

  5. Move the first exsiting (mail enabled) hosted Domain\Virtual Server onto it (changing it’s DNS - MX, SPF & A records etc at the external DNS Panel) and when mail is sent from that domain - it shouldn’t have issues as host2’s IP address resolves (assuming you can set 2 PTR records)

  6. Once all Virtual Servers have been moved - make sure all A records for myDomain.com point only to the new IP\Host.

  7. regen the cert for host2.myDomain.com to also include myDomain.com & www.myDomain.com

Do you foresee any issues with the above approach?

Many Thanks

Dibs

4

I don’t know if #2 is possible else it all looks good.

5

@calport

Many thanks for your reply. I was Googling about multiple PTR records whilst typing the previous post and it looks as if it’s fine to have 2 PTR records for the same domain but different IPs.

It’s discouraged to have multiple records for the same IP.

Thanks again.

Dibs

6

You are most welcome @Dibs. Let us know how it goes.

7

@calport

I’ll definitely post up how it goes. I suspect others (after me) will be interested in

  • how migrating from one host to another goes, along with an updated o\s (in my case Ubuntu 16.04 to 18.04)
  • enabling DKIM with external DNS
  • moving Virtual Servers.
  • creating\regenerating LE SSL certs along the way.

Thanks

Dibs

8

@calport - here you go,

9

This is excellent @Dibs. :+1:

10

@calport - thanks.

Still messing about trying to get Roundcube working. Done umpteen installs, un-installs, installs, damn thing won’t login.

Just endless 500 - Internal Server Error screens.

11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.