CentOS 7 EOL and Migration Paths

CentOS 7 reached end of life on June 30, 2024, and RHEL 7’s official Extended Lifecycle Support (ELS) ended on June 30, 2026. If your servers still run CentOS 7, the question is no longer “should I migrate” but “which migration path costs the least.” This article compares four paths and walks through the most common one step by step.

Where You Stand

Date	Event
2024-06-30	CentOS 7 end of life; official mirrors emptied
2026-06-30	RHEL 7 official ELS (Extended Lifecycle Support) ends
Now	No security patches from CentOS/RHEL at all; installing new software is a struggle

Real risks of running CentOS 7 today:

No official patches for newly disclosed vulnerabilities — internet-exposed services (SSH, web, databases) carry the highest risk
Old packages remain installable from vault.centos.org but will never be updated
Vendors keep dropping EL 7 support (PHP, Python, and OpenSSL toolchains are stuck on old versions)

Four Paths Compared

Path	Cost	Benefit	Fits
1. ELevate in-place upgrade to AlmaLinux 8 (then 9)	Medium (downtime window + testing)	Keeps data and configuration; moves into a supported release	Most legacy servers
2. Fresh install and redeploy	High (migrate apps and data)	Cleanest, no legacy baggage	Systems that are containerized or configuration-as-code
3. Commercial ELS (TuxCare, etc.)	Ongoing payment	No system changes; EL 7 patches keep arriving	Cannot migrate soon but must stay compliant
4. Isolation	Low	Risk contained at the network layer	Transition systems about to be retired

Path 1 Walkthrough: ELevate to AlmaLinux 8

The ELevate project (maintained by AlmaLinux) is built on leapp. Per the official quickstart, a CentOS 7 upgrade is one step to EL 8 only, and the only officially supported target is AlmaLinux 8 (plus CentOS Stream 8); there is no leapp-data-rocky and no Oracle Linux 8 target — swapping leapp-data-* packages does not change that. Reaching EL 9/10 takes two steps: first to AlmaLinux 8, then the EL 8 to EL 9 upgrade.

Pre-Migration Checklist

Back up all data; snapshot the VM
Confirm free disk space is at least 50% of used space
Remove third-party repositories (or confirm they have EL 8 versions)
Confirm critical applications support EL 8 (especially kernel modules and self-compiled software)
Reserve a 1-2 hour downtime window

Running the Upgrade

$ sudo yum install -y https://repo.almalinux.org/elevate/elevate-release-latest-el7.noarch.rpm
$ sudo yum install -y leapp-upgrade leapp-data-almalinux

$ sudo leapp preupgrade

The pre-check lists inhibitors and suggestions. Common fixes:

# Remove unsupported kernel modules (ploop, etc.)
$ sudo modprobe -r ploop
# Allow SSH root login (leapp requires it)
$ sudo sh -c "echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config"
# Answer the question file, then re-run the pre-check
$ sudo leapp answer --section remove_pam_kde_plasma_dependencies.confirm=True
$ sudo leapp preupgrade

$ sudo leapp upgrade
$ sudo reboot

The system enters the upgrade process on reboot. Verify afterwards:

$ cat /etc/redhat-release
$ rpm -qa | grep el7 | wc -l   # should be 0 or close to 0

Going Further to EL 9 or Switching Distributions

Upgrade to AlmaLinux 8 first, then follow the EL 8 to EL 9 upgrade as the second step (the EL8 -> EL9 sources are likewise limited to AlmaLinux 8 / CentOS Stream 8)
Want Rocky Linux? Rocky has no official in-place upgrade or migration path (migrate2rocky only converts within the same major version); the workable approach is a fresh Rocky 9/10 install plus workload migration, see migrating to Rocky
To stay on AlmaLinux, see migrating to AlmaLinux
Skipping two majors (7 -> 9/10) has no supported path; go 7 -> 8 -> 9 -> 10 step by step, or reinstall

Path 2: When a Fresh Install Is the Better Move

A reinstall is often faster and safer than an in-place upgrade when any of these hold:

The system was configured once at provisioning and untouched since, with documentation available
Applications are containerized, or rebuildable with Ansible or similar tools
The host carries lots of self-compiled software or third-party repositories of unknown origin

For fresh installs go straight to EL 9 or EL 10 (AlmaLinux or Rocky). See the installation guide for details.

FAQ

Is vault.centos.org still usable?

Yes — it holds the final snapshot from June 2024. Fine as a temporary package source, but it receives no security updates and is not suitable for the long run.

Can CentOS 7 upgrade straight to EL 9?

No. The supported chain crosses one major version at a time: CentOS 7 to EL 8, then EL 8 to EL 9. There is no supported two-hop path.

What are the commercial ELS options?

TuxCare (CloudLinux) and CIQ, among others, offer extended kernel and userspace patches for EL 7 — a good bridge for compliance-bound systems. Before signing, confirm what is covered (kernel, glibc, OpenSSL) and until when.