Swapping certs between two servers?

Help
2

If you’re worried about certificate issues, there won’t be any as long as Caddy is accessible at the IP address specified by each of its managed domains. You don’t need to copy the .caddy directory at all (unless you’ve got more domains than LetsEncrypt’s rate limit).

Requisitioning a new set of certificates is pretty quick, and you avoid transmitting your private keys (even if you would have been transmitting them securely).

With that said, you can indeed copy the entire .caddy directory, and if it’s placed in the correct location with the correct permissions, Caddy will start using them instead of requesting new ones.

If it’s absolute zero downtime you require, though, here’s how I’d do it:

  1. sudo rsync -az [old-host]:/root/.caddy /root/.caddy on [new-host]
    (or other file path as appropriate)
  2. sudo rsync -az [old-host]:/etc/Caddyfile /etc/Caddyfile on [new-host]
    (or other file path as appropriate)
  3. Replace the caddyfile on [old-host] with this:
http:// {
  proxy / http://[new-host] {
    transparent
    websocket
  }
}
https:// {
  proxy / https://[new-host] {
    transparent
    websocket
  }
  tls {
    max_certs 1
  }
}
  1. Start Caddy on [new-host]
  2. pkill -SIGUSR1 caddy on [old-host], now all new requests to either host are served by [new-host]
  3. Change DNS records, propagation time is now irrelevant
  4. Take down [old-host] after a few days, or once its access logs dry up
6 Likes