> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/configuration/what-adjustments-do-i-need-to-make-if-my-enginsight-domain-changes.md). # What adjustments do I need to make if my Enginsight domain changes? Changing the domain of your Enginsight on-premises system requires several adjustments. These include replacing and adding SSL/TLS certificates, changing the DNS configuration, and making adjustments in the Enginsight platform itself. {% hint style="danger" %} **Please note**: If the old domain is removed before the new domain has been correctly configured in all required places, and before all other necessary adjustments have been made, the Enginsight agent **Pulsar will no longer be able to send data to the Enginsight platform**! We therefore recommend that you [run both the old and the new domain in parallel](#optional-run-the-old-and-new-domain-in-parallel) for a certain period of time and regularly check that all Pulsars are working properly to ensure that all components can communicate with each other without issues. {% endhint %} Follow these steps to change the domain and make the required adjustments: {% stepper %} {% step %} ### Create a new domain with a new SSL/TLS certificate Create a new Enginsight domain and generate a new SSL/TLS certificate for it. {% endstep %} {% step %} ### Replace the old SSL/TLS certificates Follow the steps in one of the following guides from our Knowledge Base to replace your old SSL/TLS certificate with the new one and make the corresponding adjustments in the nginx configuration: * **Using Let's Encrypt**: [How do I update a SSL/TLS certificate by Let's Encrypt in Enginsight?](/docs/knowledge-base/english/configuration/how-do-i-update-a-ssl-tls-certificate-by-lets-encrypt-in-enginsight.md) * **Using a self-signed certificate**: [How do I replace a self-signed SSL/TLS certificate in Enginsight?](/docs/knowledge-base/english/configuration/how-do-i-replace-a-self-signed-ssl-tls-certificate-in-enginsight.md) {% hint style="danger" %} **Please note**: If you want to run both the old and the new domain in parallel during the migration phase (see [step 6](#optional-run-the-old-and-new-domain-in-parallel)), the old SSL/TLS certificate must not be deleted! {% endhint %} {% endstep %} {% step %} ### Change the DNS record Log in to your DNS provider and change the DNS record of the new domain so that it points to the IP address of the Enginsight Application Server. {% endstep %} {% step %} ### Apply the changes on the Application Server 1. Log in to the Enginsight Application Server and navigate to the Enginsight installation directory using the following command: ``` cd /opt/enginsight/enterprise ``` 2. Run the setup script for the Application Server anew using the following command: ``` sudo ./setup.sh ``` 3. When prompted for the URL under which the Enginsight user interface is accessed (**Enter APP URL**) and the URL under which the Enginsight API can be reached (**Enter API URL**), enter the URLs of the new domain accordingly. {% endstep %} {% step %} ### Change the API URL in the Enginsight platform You now need to change the URL to which the Pulsar sends its results **for all hosts** that are monitored with a Pulsar. 1. Log in to the Enginsight platform. 2. Navigate to **Hosts** → **Policy Manager**. 3. Either adjust an existing policy that covers all hosts or add a new policy for all hosts. 4. Scroll to **Available settings** and, in the **Advanced Settings** section, click the **Add new Setting** field. Then select the option **Customize API URL**.
5. Adjust the API URL of the new domain accordingly. {% endstep %} {% step %} ### Optional: Run the old and new domain in parallel To make sure that both the old and the new domain can be reached by all Pulsars during the migration phase, we recommend that you add both domains to the nginx configuration file during this period. The nginx configuration would then look as follows: 
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name <NewAppDomain>;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Creating dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

    ssl_dhparam /etc/nginx/dhparam.pem;

    ssl_certificate /<CustomDirectoryPath>/<NewCertificateFileName>.pem;
    ssl_certificate_key /<CustomDirectoryPath>/<NewKeyFileName>.pem;

    client_max_body_size 200m;

    location / {
        proxy_pass http://127.0.0.1:81;
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name <NewAPIDomain>;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Creating dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

    ssl_dhparam /etc/nginx/dhparam.pem;

    ssl_certificate /<CustomDirectoryPath>/<NewCertificateFileName>.pem;
    ssl_certificate_key /<CustomDirectoryPath>/<NewKeyFileName>.pem;

    client_max_body_size 200m;

    location / {
        proxy_pass http://127.0.0.1:82;
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name <OldAPIDomain>;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Creating dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

    ssl_dhparam /etc/nginx/dhparam.pem;

    ssl_certificate /<CustomDirectoryPath>/<OldCertificateFileName>.pem;
    ssl_certificate_key /<CustomDirectoryPath>/<OldKeyFileName>.pem;

    client_max_body_size 200m;

    location / {
        proxy_pass http://127.0.0.1:82;
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
}
{% hint style="info" %} Remember to replace the placeholders in `<>` accordingly: * `` * `` * `` * `` * `` * `` * `` * `` {% endhint %} {% endstep %} {% endstepper %} ***