CentOS 7 end of life: getting off it safely
CentOS 7 reached end of life on 30 June 2024. Servers still on it run software from 2014 with no free security fixes. Here are the options, from paid extended support to a clean rebuild.
- End of life
- 30 June 2024, 859 days ago
- Paid extension
- TuxCare and others, to June 2029
- Move to
- AlmaLinux or Rocky 9 or 10, or Ubuntu 26.04
- Path
- A rebuild, or ELevate 7 → 8 → 9 in place
Where CentOS 7 servers are now
More than two years past its date, a CentOS 7 server has no free security fixes for anything: the kernel, OpenSSH, OpenSSL, Apache, PHP, MariaDB. Every flaw found since June 2024 is open on it.
It may not even install software. The mirror list was switched off, so yum fails with "Could not retrieve mirrorlist" until it is pointed at vault.centos.org. That gets packages installing again, but they are the final versions, frozen.
The defaults are from a different era: PHP 5.4, Python 2.7, MariaDB 5.5, OpenSSL 1.0.2. Applications on these servers often depend on that, which is why they are still there, and why the move needs testing rather than just doing.
Your options
| Option | What it costs | What you get | When it fits |
|---|---|---|---|
| Paid extended support | A yearly fee per server, from TuxCare, OpenLogic or SUSE | Security fixes for the core packages to June 2029, with nothing else changed | A server you can't move yet, such as one with a vendor's certified software on it |
| ELevate in place | Two planned windows (7 → 8, then 8 → 9) | The same server on AlmaLinux, Rocky or Oracle Linux 9, supported to 2032 | A simple, well-documented server with few third-party repositories |
| Rebuild on AlmaLinux or Rocky | A new server running alongside the old one for a few days | A clean install of 9 (to 2032) or 10 (to 2035), the old server kept as the way back | Most CentOS 7 servers, and the team knows the RHEL way of working |
| Rebuild on Ubuntu | As above, with more configuration rewritten | Ubuntu 26.04, supported to May 2031 (2036 with Ubuntu Pro) | An estate that otherwise runs Ubuntu, so everything is patched the same way |
Dates from the CentOS project, TuxCare, AlmaLinux, Rocky Linux and Canonical, read 6 November 2026.
Why I usually rebuild
ELevate works, and on a small, tidy server it is a good choice. But a CentOS 7 server still running in 2026 is rarely small or tidy. It has usually been changed by several people over ten years, with packages from EPEL, Remi and vendors' own repositories, and nobody has the full list.
An in-place upgrade carries all of that across two major versions, and failures halfway through are hard to unwind. A rebuild starts clean, is written down as it is built, and leaves the old server untouched until the new one has passed every test. If anything is wrong, switching back is a DNS change.
What changes on the way
Moving from CentOS 7 to a release supported today is ten years of change at once.
| Package | CentOS 7 | EL 9 | EL 10 | What to watch |
|---|---|---|---|---|
| PHP | 5.4 | 8.0+ | 8.3 | The biggest job on most servers. Code written for PHP 5 needs real changes, not just testing. Newer PHP versions are available as modules on 9. |
| Python | 2.7 | 3.9 | 3.12 | No Python 2 at all. Admin scripts, monitoring checks and old tools all need porting. |
| Database | MariaDB 5.5 | 10.5 | 10.11 | Dump and reload rather than upgrading the data files in place, and test the application's queries against stricter SQL modes. |
| OpenSSL | 1.0.2 | 3.0 | 3.2 | The system crypto policy refuses TLS 1.0 and 1.1 and SHA-1 signatures. Old partner APIs and payment gateways can stop connecting. |
| Firewall | firewalld (iptables) | firewalld (nftables) | firewalld (nftables) | Many CentOS 7 servers swapped firewalld for plain iptables rules; those need rewriting for firewalld and nftables. |
| Networking | network-scripts | NetworkManager | NetworkManager | ifcfg files and service network restart go away. Extra IPs and routes are set up again. |
| Packages | yum | dnf | dnf | Repositories from EPEL 7, Remi and vendors need their EL 9 or 10 versions, if they exist. |
| Hardware | — | — | x86-64-v3 | Rocky 10 needs a newer CPU feature level than 9, which rules out some older servers and VM types. AlmaLinux 10 also ships a build for older CPUs. |
Before you move
Find every CentOS 7 server. cat /etc/centos-release on each one. Check old VMs and the machines nobody logs in to: they are usually where CentOS 7 survives.
List what is installed and from where. yum repolist for the repositories, and rpm -qa --qf '%{NAME} %{VENDOR}\n' for packages that didn't come from CentOS.
Find the PHP and Python code. Every site's PHP version needs checking against PHP 8, and every #!/usr/bin/python script against Python 3.
Save the firewall and network set-up. firewall-cmd --list-all (or iptables-save) and the files in /etc/sysconfig/network-scripts/ are the record of what has to be rebuilt.
Build the new server from a written recipe, copy the data across, test every site and job, then switch DNS or the IP. Keep the old server running, unused, until you are sure.
How I run the move
- 01Inventory and a fixed quote
What runs on the server, where every package came from, and which of the changes above will bite. Paid support, ELevate or a rebuild, with the reasons.
- 02Rehearsal on staging
A copy upgraded or rebuilt first, every site and job tested, every problem fixed there.
- 03The window, with a way back
The real move at a time you agree, the old server or a snapshot kept ready, then two weeks' stabilisation.
Upgrades and migrations →
Questions
When did CentOS 7 reach end of life?
On 30 June 2024. There have been no free security fixes since, and the repositories have moved to the archive at vault.centos.org.
Why does yum fail on CentOS 7 now?
The mirror list at mirrorlist.centos.org was switched off after end of life, so yum cannot find a repository. Pointing it at vault.centos.org makes it install packages again, but those packages will never get another security fix.
Can I still get security fixes for CentOS 7?
Only by paying. TuxCare sells Extended Lifecycle Support for CentOS 7 to June 2029, and OpenLogic and SUSE sell similar cover. It is priced per server per year.
Can I upgrade CentOS 7 in place?
Partly. The ELevate project (built on Red Hat's Leapp) upgrades 7 to 8, then 8 to 9, onto AlmaLinux, Rocky or Oracle Linux. It works on simple servers. On servers with years of changes, a rebuild is usually less work and much less risk.
AlmaLinux, Rocky Linux or Ubuntu?
AlmaLinux or Rocky if the team knows the RHEL way of doing things; version 10 is supported to 2035 and 9 to 2032. Ubuntu 26.04 (to May 2031) if your other servers run Ubuntu, so that the whole estate runs one OS.
What breaks most often moving off CentOS 7?
PHP 5.4 code, Python 2 scripts, hand-written iptables firewall rules, network-scripts interface files, and connections to old systems that only speak TLS 1.0 or use SHA-1 certificates.
Still running CentOS 7?
Tell me what's on the server. I'll tell you the safest way off it and give you a fixed quote.