#private key

Moving a site to a new host can feel like a fresh start—right up until your HTTPS stops working and that little padlock disappears. The worst part? Your certificate may be fine, but if the private key, chain, or server setup gets messed up, browsers will treat your site like it’s suddenly untrusted.

A host move can break HTTPS even when the site files transfer cleanly. The usual failure points are the certificate chain, a missing private key, or a host that cannot serve the same trust path the old one did. For sysadmins and small teams under cutover pressure, that means browser warnings, checkout failures, and search-engine trust issues right when uptime matters most.

Migrating an SSL/TLS certificate to a new host is usually simple if the private key, certificate, and intermediate chain are still available; otherwise, the cert must be reissued before cutover. The safe process is to inventory the certificate type, move or recreate the key pair, verify the chain, switch DNS, and test HTTPS, expiry, and browser trust after migration.

Key steps before the first DNS change

A clean certificate move starts before any DNS change.

1. Identify the certificate type, because DV, OV, EV, wildcard, and SAN certs behave differently. 2. Export the certificate, private key, and intermediate chain from the old host if access exists. 3. Reissue the certificate if the private key cannot move with it. 4. Install everything on the new server and test the HTTPS endpoint before cutover. 5. Switch DNS only after the new host passes browser and command-line checks. 6. Verify expiry, chain order, redirect behavior, and trust on the live site.

The private key is the lock that matches the certificate's public side.

The good news is there’s usually a very specific reason it breaks—and once you spot it, the fix is way less scary than it looks...

Casascius Bitcoin: The "Physical" Coins Carrying Billions in Digital Gold

I was cleaning out my computer of cruft from my previous employer (I was gifted this work PC when the company disappeared at the end of its bankruptcy proceedings) and came across this SSH config stanza that I actually had to do some testing to set up:

Our servers rejected SSH access from all but a handful of jumphosts - which were not jumphosts as jumphosts and bastions are usually understood by most people, but full-fledged servers with shell environments on which most of our operations/support troubleshooting activities happened - and while all the jumphosts and most of the servers beyond them would get Salted with the SSH public keys we registered in a central location (to be rotated annually), one command and control server was so critical to the operation of our services that we very rarely upgraded it - for fear of it dying in the upgrade process and paralyzing our entire business - which resulted in it 1) not getting our SSH public keys via Salt, and 2) running an SSH version so old it did not know how to handle ED25519 keys.

All this to describe why I ended up with two separate SSH private keys - one for the command and control server, and one for the jumphost thru which I would connect to that C&C.

Tunnelling through the jumphost to connect to the C&C server was straightforward:

Host command # Command & Control server HostName command.tld.com ProxyCommand ssh -q jumphost nc %h %p Host jumphost HostName jumphost.tld.com IdentityFile ~/.ssh/myprivatekey [...]

But a problem then arose: does an `IdentityFile` in the `Host command` stanza make SSH use that private key to negotiate with 1) the C&C server, or 2) the jumphost in the ProxyCommand?

So I tested, and it turns out SSH uses 1) myprivatekey to negotiate with the jumphost (in the ProxyCommand), and then 2) commandkey to negotiate with the Command & Control server.