# What Is ARI (ACME Renewal Information)? Definition and Examples

> ARI is an ACME extension, RFC 9773, in which the CA tells each client the time window in which it should renew a specific certificate.

Source: https://ssl.sh/glossary/ari/
Last updated: 2026-11-10

ARI (ACME Renewal Information), published as [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) in June 2025, adds a renewalInfo endpoint to the [ACME](https://ssl.sh/glossary/acme/) directory. The client builds an identifier from the certificate's Authority Key Identifier and serial number, queries the endpoint, and receives a suggested renewal window with start and end times plus an optional explanation URL. It then renews at a randomly chosen moment inside that window, and when ordering the replacement it names the old certificate in a replaces field.

## Why it matters
Fixed rules such as "renew 30 days before expiry" break when lifetimes change or when a CA has to revoke early. With ARI, a CA that discovers [misissuance](https://ssl.sh/glossary/misissuance/) can move the window for the affected certificates into the past, and well-behaved clients renew promptly, before [revocation](https://ssl.sh/glossary/revocation/) takes their sites offline. ARI also spreads renewals over time instead of creating load spikes, and it adapts automatically as maximum validity shrinks to 200, 100 and then 47 days under Ballot SC-081v3.

## Example
A renewalInfo response:

```json
{
  "suggestedWindow": {
    "start": "2026-11-20T08:00:00Z",
    "end": "2026-11-21T08:00:00Z"
  },
  "explanationURL": "https://example.com/incident"
}
```

The client checks this regularly and renews once the current time passes a random point inside the window.

## Common misconceptions
- **ARI replaces expiry-based renewal logic entirely.** Clients should still fall back to a sensible default when the CA does not support ARI or the endpoint is unreachable.
- **ARI is a Let's Encrypt-only feature.** It is an IETF standard that any ACME CA can implement.
- **Every certificate gets the same window.** The CA sets the window per certificate, which is how it can target only the certificates affected by an incident.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [证书续期](https://ssl.sh/zh/glossary/certificate-renewal/): 证书续期是在证书到期前申请一张新证书来替换它，最好全自动完成并同时更换密钥对。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [ACME Profile](https://ssl.sh/zh/glossary/acme-profile/): ACME Profile 是 CA 在 ACME 目录中公布的命名证书模板，客户端下单时选择它来决定证书的有效期和内容。