Skip to main content
Some custom subdomains still use a legacy SSL certificate. Migrating moves your subdomain to Fingerprint’s current certificate setup, which improves performance and identification accuracy. You start the migration in the dashboard, replace your subdomain’s A records, and then finish the migration once the new certificate is active. Your subdomain name, JavaScript agent configuration, and visitor IDs stay the same, so you don’t need to change any code.
Legacy certificates are being retired
  • Deprecation date: October 31, 2026
  • Sunset date: October 31, 2027
After the sunset date, subdomains that still use a legacy certificate stop working. Migrate your subdomains before October 31, 2027.

​
Check if your subdomain uses a legacy certificate

If any of your subdomains use a legacy certificate, the workspace overview shows an Action needed notice. Select Manage Subdomains to open the list of your subdomains. You can also go to Settings > Subdomains directly. Subdomains with a legacy certificate have a Legacy tag and a Migrate button. If you already started a migration, the button reads Resume migration instead.
Subdomains page with two subdomains tagged Legacy, one with a Resume migration button and one with a Migrate button

Legacy subdomains on the Subdomains page

​
Before you start

  • Make sure you or your DNS administrator can edit the DNS records for your domain.
  • Choose a quiet period for the migration. Avoid migrating during a product launch, a proof of concept, or peak traffic. Migrate before such an event, leaving time for DNS changes to propagate, or after it.
  • Plan for at least 24 hours between updating your DNS records and finishing the migration.

​
Migration overview

  1. Start the migration in the dashboard. Your current certificate keeps serving traffic.
  2. Replace the old A records with the new ones in your DNS.
  3. Wait for the DNS changes to propagate.
  4. Verify that identification works on your website.
  5. Finish the migration. This step can’t be undone.
Until you finish the migration, you can change back to the old A records at any time and your current setup keeps working.

​
Step 1: Start the migration

Go to Settings > Subdomains and select Migrate next to the legacy subdomain. Fingerprint prepares a new certificate for the same subdomain. Nothing changes for your live traffic yet, because the old certificate keeps serving requests until you finish the migration. You can leave at any point and come back later. Select Resume migration to continue where you stopped.

​
Step 2: Replace your DNS records

The subdomain page lists the exact DNS records for your migration: the new A records to add, and the old A records that must be removed. In your DNS provider:
  1. Add the new A records listed under Configure DNS records. To import them in bulk, select Download zone file.
  2. Delete the old A records listed under The following records must be removed.
  3. If the dashboard shows a CAA record, add it as well. For details, see Conflicting CAA records.
  4. If you use Cloudflare DNS, set the records to DNS only, not Proxied.
Replace the old A records, don’t just add the new ones. If the old A records stay in place, the dashboard shows the new records as Validated but the old ones as To be removed, and you can’t continue the migration.
Configure DNS records step showing two new A records marked Validated and two old A records marked To be removed

The new records are validated, but the old A records still need to be removed

Fingerprint checks your records automatically. To run a check right away, select Check DNS records. Once all new records show Validated and all old records show Removed, Fingerprint issues the new certificate and the subdomain status changes to Active. DNS changes can take up to 24 hours to propagate. This doesn’t affect your traffic, because the old certificate is still live.

​
Step 3: Wait for the DNS changes to propagate

The Finish migration button becomes available 24 hours after your DNS records are correct and the new certificate is issued. The wait gives your DNS changes time to reach all visitors. As the changes propagate, visitors start reaching your subdomain through the new certificate. Use this time to confirm that identification works on your website.

​
Step 4: Verify identification

Open your website and confirm that identification works:
  • In the Network tab of your browser’s developer tools, requests to your subdomain succeed without certificate errors.
  • New identification events from your website appear on the Events page in the dashboard.

​
Step 5: Finish the migration

Finishing the migration can’t be undone. After you finish, you can’t roll back by restoring your old DNS records.
Select Finish migration. Fingerprint switches off the old certificate within about a minute.
Subdomain page showing an issued certificate and a Finish migration button

The new certificate is active and the migration is ready to finish

​
Troubleshooting

​
The old records still show To be removed

The old A records are still in your DNS, or DNS caches haven’t expired yet. Make sure you deleted the old records, not just added the new ones. To check what your DNS returns, run the following command, replacing metrics.yourwebsite.com with your subdomain:
The output should list only the new IP addresses shown in the dashboard.

​
DNS validation timed out

If the new records aren’t validated in time, the subdomain status changes to Timed out. Your live subdomain isn’t affected. Select Restart, then make sure the DNS records shown in the dashboard are in place.

​
Contact support

Contact the support team if:
  • The dashboard still shows Validating DNS records more than 24 hours after you updated your records, and the records look correct.
  • You see errors after you finished the migration.
  • Your DNS setup is unusual and you aren’t sure how to apply the changes.