Search code examples
securityssliis-7servertransfer

Transfer SSL to new server for the same domain IIS7

I will need to move one web site to a new server that hasn't been prepared yet. I have a couple of questions:

Can you transfer SSL from one server to another? Domain name will remain the same.

Does it have to be the same server? i.e does it have to be IIS7 again? Can you transfer from IIS7 to Linux?

Can I just install the same file on new server and will it all work? Do I need to take anything else into account?

Oskar

Solution

  • Provided the private key associated to the certificate was NOT marked as "non exportable", yes you can transfer an SSL Server certificate and key to another server.

    The best way to know it is try to export the SSL Server certificate and make sure the "export private key" is checked. More details here (https://technet.microsoft.com/en-us/library/cc754329.aspx)[https://technet.microsoft.com/en-us/library/cc754329.aspx]. If the export private key is grayed out you won´t be able to export the key and hence reuse the certificate and key in a different server.

    This will create a password protected PKCS12 container, also known as a PFX file due to the windows extension, containing the certificate, the private key and possibly the certificate chain up to a Root CA. If the new server is a windwos you can use the PKCS12 container (pfx file) ti import all at once to the server. If the server is a i linux it will depend on the type of web server but assuming is a an Apache you´ll need to extract the certificate, key and certificate chains to different files.

    You can use the commands from (https://stackoverflow.com/questions/9497719/extract-public-private-key-from-pkcs12-file-for-later-use-in-ssh-pk-authentifica)[https://stackoverflow.com/questions/9497719/extract-public-private-key-from-pkcs12-file-for-later-use-in-ssh-pk-authentifica] to extract the certificates and private key:

    • Private key:

      openssl pkcs12 -in yourP12File.pfx -nocerts -out privateKey.pem

    • Certificates:

      openssl pkcs12 -in yourP12File.pfx -clcerts -nokeys -out publicCert.pem