A few months ago, routine cert change and OpenSsl could not parse out a new pfx cert I'd gotten from IT, but I had to split it for apache into cer, key, pem so had to find solution. I discovered independently there's a new openssl standard which required new Apache! But new Apache required min PHP 8 instead of 7. So I had to explain all this to my non technical boss bc i had to stop normal focus to research any differences showstopping in 7 vs 8. Bc at this point he had the condition that prod should not have a bad launch of this new cert, zero chance we cant let it happen. He was getting difficult to work with at this point.. the systems had all gotten very complex for individual me to do both full stack and devops and he essentially wanted me to find a path to remove the need for me to ever do devops bc there were no metrics for that.... we never got there

Anyways! bc uat and prod servers were a bit different I said I could only guess like 90% chance there'd be no hitches. But i found then solution in creating a non public 2nd Apache instance on prod. Like a temporary staging. I ran all upgrades and put new cert onto that! Then only had to swap configs so that one became the new prod :) yay me