Certificate Renewal

Certificate renewal replaces an expiring certificate with a newly issued one for the same names. Technically nothing is extended: the CA issues a new certificate with a new serial number and new validity dates, after repeating any validation whose reuse period has lapsed. Good practice is to generate a new key at the same time (key rotation) and to renew well before expiry, commonly when about a third of the lifetime remains, or when the CA's ARI signal says so.

Why it matters

Expired certificates cause hard browser errors and broken API calls, and renewal frequency is rising. Under CA/Browser Forum Ballot SC-081v3, maximum validity is 200 days for certificates issued from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, with domain validation reuse shrinking alongside. Let's Encrypt stopped sending expiration reminder emails on 2025-06-04, so monitoring is your responsibility. In practice that means ACME automation plus independent expiry checks against what the server actually serves.

Example

certbot renew --deploy-hook "systemctl reload nginx"
# confirm what the server is actually serving
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

Common misconceptions

• Renewal extends the existing certificate. It always produces a new certificate; the old one stays valid until it expires or is revoked.
• A renewed file on disk means the site is renewed. The server must reload; processes still serving the old certificate are a frequent cause of expiry outages.
• The CA will remind me. Do not rely on email reminders; Let's Encrypt has stopped them, and others may land in an unread inbox.