> ## Documentation Index > Fetch the complete documentation index at: https://docs.fingerprint.com/llms.txt > Use this file to discover all available pages before exploring further. # Migrate a legacy subdomain certificate > Move your custom subdomain to the current SSL certificate setup without changing your subdomain or JavaScript agent configuration. Some [custom subdomains](/docs/custom-subdomain-setup) still use a legacy SSL certificate. Migrating moves your subdomain to Fingerprint's current certificate setup, which improves performance and identification accuracy. You start the migration in the dashboard, replace your subdomain's A records, and then finish the migration once the new certificate is active. Your subdomain name, JavaScript agent configuration, and visitor IDs stay the same, so you don't need to change any code. **Legacy certificates are being retired** * **Deprecation date**: October 31, 2026 * **Sunset date**: October 31, 2027 After the sunset date, subdomains that still use a legacy certificate stop working. Migrate your subdomains before October 31, 2027. ## Check if your subdomain uses a legacy certificate If any of your subdomains use a legacy certificate, the [workspace overview](https://dashboard.fingerprint.com/overview) shows an **Action needed** notice. Select **Manage Subdomains** to open the list of your subdomains. You can also go to **Settings** > [**Subdomains**](https://dashboard.fingerprint.com/subdomains) directly. Subdomains with a legacy certificate have a **Legacy** tag and a **Migrate** button. If you already started a migration, the button reads **Resume migration** instead. Subdomains page with two subdomains tagged Legacy, one with a Resume migration button and one with a Migrate button ## Before you start * Make sure you or your DNS administrator can edit the DNS records for your domain. * Choose a quiet period for the migration. Avoid migrating during a product launch, a proof of concept, or peak traffic. Migrate before such an event, leaving time for DNS changes to propagate, or after it. * Plan for at least 24 hours between updating your DNS records and finishing the migration. ## Migration overview 1. Start the migration in the dashboard. Your current certificate keeps serving traffic. 2. Replace the old A records with the new ones in your DNS. 3. Wait for the DNS changes to propagate. 4. Verify that identification works on your website. 5. Finish the migration. This step can't be undone. Until you finish the migration, you can change back to the old A records at any time and your current setup keeps working. ## Step 1: Start the migration Go to **Settings** > [**Subdomains**](https://dashboard.fingerprint.com/subdomains) and select **Migrate** next to the legacy subdomain. Fingerprint prepares a new certificate for the same subdomain. Nothing changes for your live traffic yet, because the old certificate keeps serving requests until you [finish the migration](#step-5-finish-the-migration). You can leave at any point and come back later. Select **Resume migration** to continue where you stopped. ## Step 2: Replace your DNS records The subdomain page lists the exact DNS records for your migration: the new A records to add, and the old A records that must be removed. In your DNS provider: 1. Add the new A records listed under **Configure DNS records**. To import them in bulk, select **Download zone file**. 2. Delete the old A records listed under **The following records must be removed**. 3. If the dashboard shows a CAA record, add it as well. For details, see [Conflicting CAA records](/docs/custom-subdomain-setup#conflicting-caa-records). 4. If you use Cloudflare DNS, set the records to **DNS only**, not **Proxied**. Replace the old A records, don't just add the new ones. If the old A records stay in place, the dashboard shows the new records as **Validated** but the old ones as **To be removed**, and you can't continue the migration. Configure DNS records step showing two new A records marked Validated and two old A records marked To be removed Fingerprint checks your records automatically. To run a check right away, select **Check DNS records**. Once all new records show **Validated** and all old records show **Removed**, Fingerprint issues the new certificate and the subdomain status changes to **Active**. DNS changes can take up to 24 hours to propagate. This doesn't affect your traffic, because the old certificate is still live. ## Step 3: Wait for the DNS changes to propagate The **Finish migration** button becomes available 24 hours after your DNS records are correct and the new certificate is issued. The wait gives your DNS changes time to reach all visitors. As the changes propagate, visitors start reaching your subdomain through the new certificate. Use this time to confirm that identification works on your website. ## Step 4: Verify identification Open your website and confirm that identification works: * In the **Network** tab of your browser's developer tools, requests to your subdomain succeed without certificate errors. * New identification events from your website appear on the [**Events**](https://dashboard.fingerprint.com/events) page in the dashboard. ## Step 5: Finish the migration Finishing the migration can't be undone. After you finish, you can't roll back by restoring your old DNS records. Select **Finish migration**. Fingerprint switches off the old certificate within about a minute. Subdomain page showing an issued certificate and a Finish migration button ## Troubleshooting ### The old records still show To be removed The old A records are still in your DNS, or DNS caches haven't expired yet. Make sure you deleted the old records, not just added the new ones. To check what your DNS returns, run the following command, replacing `metrics.yourwebsite.com` with your subdomain: ```bash theme={"theme":"github-dark-dimmed"} dig A metrics.yourwebsite.com +short ``` The output should list only the new IP addresses shown in the dashboard. ### DNS validation timed out If the new records aren't validated in time, the subdomain status changes to **Timed out**. Your live subdomain isn't affected. Select **Restart**, then make sure the DNS records shown in the dashboard are in place. ### Contact support Contact the [support team](https://fingerprint.com/support/) if: * The dashboard still shows **Validating DNS records** more than 24 hours after you updated your records, and the records look correct. * You see errors after you finished the migration. * Your DNS setup is unusual and you aren't sure how to apply the changes.