Move Let's Encrypt Certificates to a New Server

Moving a site to a new server? You can copy the Let's Encrypt setup across, renewal settings included, or simply issue fresh certificates once DNS points at the new machine. Both are covered here.

Full guide: Full Let's Encrypt guide

1. Easiest: issue new certificates

Install Certbot on the new server, switch DNS, then request certificates there. Nothing to copy.

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

2. Or copy the whole setup (keeps HTTPS working before DNS switches)

Archive /etc/letsencrypt as root; tar keeps the symlinks in live/ intact.

sudo tar czpf letsencrypt.tgz -C /etc letsencrypt
scp letsencrypt.tgz user@new-server:

3. Restore on the new server

sudo tar xzpf letsencrypt.tgz -C /etc
sudo apt install certbot python3-certbot-nginx

4. Check the renewal config

Each file in /etc/letsencrypt/renewal/ names the plugin and paths used. Update them if the new server uses a different web server or webroot.

sudo grep -E 'authenticator|installer|webroot' /etc/letsencrypt/renewal/*.conf

5. Verify after the DNS switch

sudo certbot renew --dry-run
sudo certbot certificates

6. Troubleshooting

Copied files but renewal fails: the old server still answers for the domain (DNS not switched), or the authenticator plugin is not installed on the new server. Never run both servers' timers for the same names after the move; remove Certbot's renewal on the old server.

FAQ

Do I have to revoke the old certificate?

No, unless the old server or its private key may be compromised. Just stop renewal there.

Can I copy only the live folder?

No. live/ contains symlinks into archive/, and renewal needs renewal/ and accounts/. Copy the whole /etc/letsencrypt.

Further reading: Certbot user guide