# Move to HA set up from non HA

**URL:** <https://openziti.discourse.group/t/move-to-ha-set-up-from-non-ha/2450>\
**Category:** General Questions\
**Created:** [April 19, 2024, 8:53pm UTC](https://openziti.discourse.group/t/move-to-ha-set-up-from-non-ha/2450 "2024-04-19T20:53:11Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [February 10, 2025, 6:45pm UTC](https://openziti.discourse.group/t/move-to-ha-set-up-from-non-ha/2450/4 "2025-02-10T18:45:00Z")

</div>

Hi @Fabio72 welcome to the community and to OpenZiti!

> [@Fabio72](#):
>
> I'm amazed by openziti.

😊 that's great!

> [@Fabio72](#):
>
> I slightly customized the controller: I changed the default port to 443 and I split the management and the client apis.

Nice!

> [@Fabio72](#):
>
> My server certificate does not have a SPIFFE ID so I need to recreate it.  
> Is it sufficient to follow this post:

From the quickstart -- no this won't be sufficient. I have been getting ready to comment about HOW one might actually accomplish this.

* * *

**MAKE SURE YOU BACKUP FIRST**

Here are my notes. Given what you've already accomplished, I expect you'll hit no issues here and realize you need all the variables set properly...

**MAKE SURE YOU BACKUP FIRST**

* * *

Did you backup??? 🙂 You can just cp -r the entire quickstart folder. That's the easiest thing to do imo.

```auto
ziti pki create server \
	--spiffe-id spiffe://$EXTERNAL_DNS/controller/migrated \
	--dns "$EXTERNAL_DNS,$(hostname),localhost" \
	--ip "$EXTERNAL_IP,127.0.0.1" \
	--pki-root "$ZITI_PKI" \
	--ca-name "$ZITI_PKI_CTRL_INTERMEDIATE_NAME" \
	--key-file "${EXTERNAL_DNS}-server" \
	--server-file controller.2025.server \
	--server-name migrated
ziti pki create client \
	--spiffe-id spiffe://$EXTERNAL_DNS/controller/migrated \
	--pki-root "$ZITI_PKI" \
	--ca-name "$ZITI_PKI_CTRL_INTERMEDIATE_NAME" \
	--key-file "${EXTERNAL_DNS}-server" \
	--client-file controller.2025.client \
	--client-name migrated

NEW_CTRL_SERVER_CERT=$(realpath $(find . -name "*2025*server*chain*" | grep $ZITI_PKI_CTRL_INTERMEDIATE_NAME))
NEW_CTRL_CLIENT_CERT=$(realpath $(find . -name "*2025*client*chain*" | grep $ZITI_PKI_CTRL_INTERMEDIATE_NAME))

ziti pki create server \
	--spiffe-id spiffe://$EXTERNAL_DNS/controller/migrated \
	--dns "$EXTERNAL_DNS,$(hostname),localhost" \
	--ip "$EXTERNAL_IP,127.0.0.1" \
	--pki-root "$ZITI_PKI" \
	--ca-name "$ZITI_PKI_CTRL_EDGE_INTERMEDIATE_NAME" \
	--key-file "${EXTERNAL_DNS}-server" \
	--server-file controller.2025.server \
	--server-name migrated
ziti pki create client \
	--spiffe-id spiffe://$EXTERNAL_DNS/controller/migrated \
	--pki-root "$ZITI_PKI" \
	--ca-name "$ZITI_PKI_CTRL_EDGE_INTERMEDIATE_NAME" \
	--key-file "${EXTERNAL_DNS}-server" \
	--client-file controller.2025.client \
	--client-name migrated

NEW_EDGE_SERVER_CERT=$(realpath $(find . -name "*2025*server*chain*" | grep $ZITI_PKI_CTRL_EDGE_INTERMEDIATE_NAME))
NEW_EDGE_CLIENT_CERT=$(realpath $(find . -name "*2025*client*chain*" | grep $ZITI_PKI_CTRL_EDGE_INTERMEDIATE_NAME))

echo "Update your controller config file. "
echo "Assuming you ran a quickstart, you should have a separate PKI for CTRL/EDGE"
echo ""
echo "Modify the control plane identity block with:"
echo "server_cert: \"${NEW_CTRL_SERVER_CERT}\""
echo "cert: \"${NEW_CTRL_CLIENT_CERT}\""
echo ""
echo "Modify the edge api identity block with:"
echo "server_cert: \"${NEW_EDGE_SERVER_CERT}\""
echo "cert: \"${NEW_EDGE_CLIENT_CERT}\""

```

> [@Fabio72](#):
>
> After restarting my controller with the raft part and the update server certificate, I should have a running one node cluster. That's right?

Yes.

> [@Fabio72](#):
>
> How do I add the second node?

We are working on finalizing this doc still. So you're catching us right in the middle of getting that doc out. Paul merged some doc JUST TODAY you can find at [Operating a Controller Cluster | OpenZiti](https://openziti.io/docs/reference/ha/operations)

Let's start there and move on once you have a look at my reply

---

_[View the full topic](https://openziti.discourse.group/t/move-to-ha-set-up-from-non-ha/2450)._