The IP Migration - Should I worry with SSL

[nhdonny]

I installed my first ever cert in December with my first ever dedicated IP. I plead total ignorance.

Site is running on NT22
The dedicated IP is 216.157.137.241
I have a Quick SSL Cert
Payquake w/authorize.net

Matts Nov. Post shows the Win Servers changing to the 145 block but those numbers may have changed since then since the name server plan was different back then.

per the nov. 18,2003 post
// Win Servers
216.157.145.1XX - ntXX.hsphere.cc

http://www.matrixreseller.net/forum/...ight=migration

Will my IP be changing?
Will I need to reinstall the cert?
Will Matt go, "Hrmmmph, not another dumb ass designer"?

Confusion rules.

[jmbeach]

yeah, the announcement was a little vague for those who may be using dedicated IP's for reasons other than just to have it on their site.

When you update the IP's, are you also making the necessary changes to HSphere so that the IP's we're using now reflect the new ones replacing them?

[admin]

Yes everything will be updated from H-Sphere to DNS to the server. We are going to do one to 2 servers per week. The site will be running on 2 IPs till the DNS takes place then we go back and remove the old IPs. We are just trying to get all of our IPs right, since we have grown so fast IPs kind of got tossed around a little to much. This should cut down a LOT of ARPs going over the network.

[vonbrocklin]

I have several clients using IP only accounts, with exteral A RECORDS pointing web traffic back to the IP. I do not want any downtime and I will move these sites away from Vortech if I have to, but nobody has answered my support ticket from over the weekend. Any advice?

[jmbeach]

vonbrocklin, the feeling I get from Brad's comment above is that they will actually be updating all custom IP's and any DNS settings that utilize those in HSphere automatically. At least that's what I hope happens, because I have some issues similar to yours.

[vonbrocklin]

Maybe I am being dense, but unless the IP stays the exact same, I am going to have issues because I have A records pointing to a specific IP. In other words, I need the exact same IP that I have now or else I will have to update the external A RECORDS to point to the new IP. Or am I missing something obvious?

We will be updating DNS and running sites on both IPs for a few days during hte migration. If you are using custom DNS point to your Dedicated IP, then you need to pay close attention to the forum when we announce that your server is scheduled to be moved. Once the migration is complete you can access the new dedicated IP from the CP and update your records accordingly... 3-5 days should be plenty of time.

[Carly]

Ideally you'd be using the hostname rather than an IP address for any connection to websites on our system. However, we will be posting which servers are being changed and leaving the old IPs on the server for several days so you should have plenty of time to update any external records to reflect any IP changes before the old IP is removed from the server.

EDIT: Oops, I didn't see Matt posting...

[Brangwyn]

Not everyone uses Vortech's DNS though I have many customers that don't, hence the issues with A records an IP addrs.

All dedicated sites will be given ample time to change anything that depends on the IP address, whether their use of an IP address is necessary or ill-advised. After the change is made, both sets of IP addresses will run in parallel for at least 72 hours before the old one is taken off and recycled a week or more afterwards.

I suppose the only exceptions to this are the hopefully very, very few, if any, sites that have bought an SSL certificate for an IP address. Had they asked us before they did it we'd have told them that it's a Really Bad Idea.

[Brangwyn]

I'm not sure if 72 hours is going to be enough, I have one ISP here in NZ that regulary takes 100-120 hours to update (I know thats not actually your problem that they set their own cache periods and seem to ignore TTLs to some extent).

I didn't think you could buy SSL certs for IP addresses actually ?

[Silverbug]

Which isp is that Brangwyn? (just out of curiosity) and yeah im pretty sure you cant buy secure certs for ip addresses

[Brangwyn]

TelstraParadise had numerous problems before with them caching records for much longer than the TTL has specified

[jmbeach]

Originally Posted by vonbrocklin

Maybe I am being dense, but unless the IP stays the exact same, I am going to have issues because I have A records pointing to a specific IP. In other words, I need the exact same IP that I have now or else I will have to update the external A RECORDS to point to the new IP. Or am I missing something obvious?

sorry VB, I'm the dense one

Didn't follow your initial post - now I see your issue. Here's a time when we hope all resellers get the message regarding this change. Could be a real doozy...

[nhdonny]

I knew that Geotrust required me to have a dedicated IP before I could install the SSL Cert back in December. But according to the FAQ the cert is bound to the domain while the protocol is bound to a static IP. Therefore I assume that when the IP switch is made it will be transparent to me. I guess the worse thing is I'll have to re-install the cert which I hope not because I bet I then have to regenerate the key. Fingers crossed - I still have nightmares from a previous, helpless host changing pipelines. Famous last words "It won't affect any hosted sites". But then Ryan at unamed host really is helpless and Matt at Vortech is a binary god.

01001101011000010111010001110100001000000101001001 101111011000110110101101110011

or 6D61747420726F636B7300

From the Geotrust FAQ

Why do I need a separate IP address per domain that I want to secure?
You need to have a separate IP address for each domain you want to secure. The reason for this is because a certificate is bound only to a domain name but, the SSL protocol is bound to static IP addresses; therefore, any certificate-enabled web site must have its own unique IP address.The IP can be real (routable) or internal (RFC 1918 non-routable address) but, it must be unique on a server.