CIQ partner

CentOS 7 extended support: patches until 2028

CentOS 7 stopped getting patches in June 2024, but plenty of servers cannot be migrated overnight. With CIQ Bridge, fixes for serious vulnerabilities keep coming until 2028, and in the meantime we plan and carry out the move to Rocky Linux, one server at a time.

Talk to a Linux engineerMessage us on WhatsApp

Nothing to reinstall to get started: Bridge is added as one more repository and updated with yum.

What CentOS 7 end of life (EOL) means

Since 30 June 2024, every new CentOS 7 vulnerability stays open. And there are good reasons to keep running it: an application that will not start on newer releases, a vendor that certifies nothing else, or hundreds of servers that take time to move. But an unpatched server fails Cyber Essentials and is a finding in any PCI DSS audit.

CIQ Bridge keeps patching CentOS 7 until 2028. It comes from CIQ, the company of Gregory Kurtzer, co-founder of CentOS and creator of Rocky Linux, so the road afterwards is already mapped out. It does not replace the migration; it buys you the time to do it properly, without exposed servers in the meantime.

What CIQ Bridge includes
PatchesSerious vulnerabilities (CVSS 7 to 10) in the critical CentOS 7 packages, until 2028.
DeliveryA private CIQ repository, used with plain yum. It also includes the CentOS 7.9 mirror.
For your scannerEvery fix is published in CSAF format, read by Qualys, Tenable and similar tools.
KernelThe CentOS 7.9 kernel, 3.10: the system keeps its version and its behaviour.
Wherex86_64, in your data centre or in the cloud.
Not includedNon-security updates and new drivers.

Bridge covers you to 2028; Rocky, to 2035

In grey, the free patches for each release; in green, what CIQ adds. Move to Rocky 9 or 10 and you get free patches until 2032 or 2035 at no extra cost. Data from CIQ and Rocky Linux, subject to change.

CentOS 7
Today
end 2028
Rocky 8
May 2032
Rocky 9
May 2032
Rocky 10
May 2035
201420162018202020222024202620282030203220342036
  • Free patches
  • With CIQ (Bridge or RLC Pro LTS)

How to migrate from CentOS 7 to Rocky Linux

There is no one-command jump from CentOS 7: between 7 and 8 the kernel, Python, the package manager and many libraries all change. So we do it in phases, with Bridge covering the servers that have not moved yet.

First, an inventory of servers and what runs on each one. Then new servers on Rocky 8 or 9 (or RLC Pro if you need a fixed release or FIPS), a test in pre-production, and the applications moved across one by one. More in migration to Linux.

Path from CentOS 7 to Rocky Linux
MeanwhileCIQ Bridge on the CentOS 7 servers
TargetRocky Linux 8 or 9, or RLC Pro
HowNew servers and applications moved one by one; ELevate on the simple ones
FinallyBridge is cancelled once no CentOS 7 is left

What should you do with your CentOS 7 servers?

CIQ Bridge

If you need time: applications that will not run on newer releases, a vendor that certifies nothing else, or many servers to move.

Move to Rocky Linux

If your applications already run on 8 or 9. It is free and RHEL-compatible, and we look after it.

Move to RLC Pro

If you need to stay on one release for years, FIPS 140-3 or CIQ behind you. More on RLC Pro.

Move to RHEL

If your application vendor only certifies Red Hat. We do that too: Red Hat support. More in moving from CentOS to Red Hat.

Most companies combine them: Bridge on what cannot move yet, migration for everything else. All the options on Rocky Linux support.

What we bring

The patch repository is CIQ's; the plan, the migration and the support are ours.

  1. Inventory

    What runs on each CentOS 7

    Servers, applications, dependencies, and what can move now and what cannot.

  2. Bridge

    Patched from day one

    We set up the subscription, add the repository and connect the CSAF feed to your scanner.

  3. Plan

    Order and dates

    Lowest risk first, with a retirement date for every CentOS 7 server.

  4. Migration

    To Rocky Linux or RLC Pro

    New servers, a test in pre-production and the applications moved across one by one.

  5. Day to day

    Support in English, Spanish or French

    24/7 or 8×5, for the CentOS 7 servers still running and for the ones already migrated.

Frequently asked questions

Is CentOS 7 still supported?

Not officially. CentOS 7 reached end of life on 30 June 2024 and its repositories have been archived. Since then, security patches only come from third-party services such as CIQ Bridge.

How long does CIQ Bridge patch CentOS 7?

Until 2028, four years after end of life. It covers serious vulnerabilities (CVSS 7 to 10) in a list of critical packages that CIQ publishes and maintains.

What does CIQ Bridge not cover?

Non-security updates, new drivers and kernel changes: it stays on the CentOS 7.9 kernel, 3.10. It is x86_64 only. Vulnerabilities below CVSS 7 are handled separately, as a service.

Can I upgrade CentOS 7 to Rocky Linux in place?

On simple servers, yes: ELevate, from the AlmaLinux project, upgrades CentOS 7 to Rocky Linux 8 in place. In production we usually prefer new Rocky 8 or 9 servers and moving the applications across, because it is easier to test and to roll back. CIQ's one-command switch (migrate2rlc) only works from versions 8 and 9.

Will CentOS 7 pass Cyber Essentials or PCI DSS?

Not without patches. Cyber Essentials expects high and critical updates within 14 days, and PCI DSS asks for critical patches within a month. With Bridge, every fix is published in CSAF format, which scanners such as Qualys or Tenable read, so your report shows the vulnerabilities as fixed.

Tell us how many CentOS 7 servers you have

With your list of servers and what runs on each one, we will tell you which to cover with Bridge, which to migrate now and in what order.

Send us your inventoryMessage us on WhatsApp