# What Is Certificate Renewal? Definition and Examples

> Certificate renewal is obtaining a new certificate to replace one that is about to expire, ideally automatically and with a fresh key pair.

Source: https://ssl.sh/glossary/certificate-renewal/
Last updated: 2026-11-10

Certificate renewal replaces an expiring certificate with a newly issued one for the same names. Technically nothing is extended: the CA issues a new certificate with a new serial number and new validity dates, after repeating any validation whose reuse period has lapsed. Good practice is to generate a new key at the same time ([key rotation](https://ssl.sh/glossary/key-rotation/)) and to renew well before expiry, commonly when about a third of the lifetime remains, or when the CA's [ARI](https://ssl.sh/glossary/ari/) signal says so.

## Why it matters
Expired certificates cause hard browser errors and broken API calls, and renewal frequency is rising. Under CA/Browser Forum Ballot SC-081v3, maximum validity is 200 days for certificates issued from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, with domain validation reuse shrinking alongside. Let's Encrypt stopped sending expiration reminder emails on 2025-06-04, so monitoring is your responsibility. In practice that means [ACME](https://ssl.sh/glossary/acme/) automation plus independent expiry checks against what the server actually serves.

## Example
```bash
certbot renew --deploy-hook "systemctl reload nginx"
# confirm what the server is actually serving
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate
```

## Common misconceptions
- **Renewal extends the existing certificate.** It always produces a new certificate; the old one stays valid until it expires or is revoked.
- **A renewed file on disk means the site is renewed.** The server must reload; processes still serving the old certificate are a frequent cause of expiry outages.
- **The CA will remind me.** Do not rely on email reminders; Let's Encrypt has stopped them, and others may land in an unread inbox.

## Related terms

- [有效期](https://ssl.sh/zh/glossary/validity-period/): 有效期是证书中 notBefore 与 notAfter 两个时间之间的区间，只有在此区间内客户端才会接受这张证书。
- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。
- [密钥轮换](https://ssl.sh/zh/glossary/key-rotation/): 密钥轮换是按计划或在安全事件后，用新生成的密钥替换旧密钥，以限制密钥泄露造成损失的做法。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。
- [证书生命周期管理](https://ssl.sh/zh/glossary/certificate-lifecycle-management/): 证书生命周期管理（CLM）是对证书从发现、申请、部署、续期到吊销全过程进行跟踪和自动化的做法与工具。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。