From 0d5793d05d73c67f915692d16d76a3559ea0740e Mon Sep 17 00:00:00 2001 From: Dan Guido Date: Fri, 28 Nov 2025 04:25:05 -0500 Subject: [PATCH] Add FAQ about migrating clients to a new Algo server (#14890) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses a long-standing user question about whether existing VPN clients can be migrated when deploying a new Algo server. The answer: technically possible but rarely worth it, since servers auto-update their VPN software anyway. Closes #1538 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude --- docs/faq.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/faq.md b/docs/faq.md index bfc5ebda..629fdd96 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -10,6 +10,7 @@ * [Why does Algo support only a single cipher suite?](#why-does-algo-support-only-a-single-cipher-suite) * [Why doesn't Algo support censorship circumvention?](#why-doesnt-algo-support-censorship-circumvention) * [I deployed an Algo server. Can you update it with new features?](#i-deployed-an-algo-server-can-you-update-it-with-new-features) +* [Can I migrate my existing clients to a new Algo server?](#can-i-migrate-my-existing-clients-to-a-new-algo-server) * [Where did the name "Algo" come from?](#where-did-the-name-algo-come-from) * [Can DNS filtering be disabled?](#can-dns-filtering-be-disabled) * [Does Algo support zero logging?](#does-algo-support-zero-logging) @@ -79,6 +80,12 @@ As a result, once your Algo server has been deployed, it is yours to maintain. I As an extension of this rationale, most configuration options (other than users) available in `config.cfg` can only be set at the time of initial deployment. +## Can I migrate my existing clients to a new Algo server? + +Technically yes, but it's rarely worth the effort. WireGuard clients would need their server endpoint and public key updated. IPsec clients additionally require securely copying the CA certificate and potentially regenerating client certificates. Since your existing server auto-updates its VPN software via unattended-upgrades, there's usually no benefit to migrating—you already have the latest security patches for strongSwan, WireGuard, and dnscrypt-proxy. + +If you need features from a newer Algo release, deploy a fresh server and redistribute new client configs. This is simpler and more secure than attempting key migration. + ## Where did the name "Algo" come from? Algo is short for "Al Gore", the **V**ice **P**resident of **N**etworks everywhere for [inventing the Internet](https://www.youtube.com/watch?v=BnFJ8cHAlco).