Renewal requires a valid certificate to be issued and installed before the current one expires. Paying an invoice alone does not prove that the certificate presented to visitors has changed. Keep the commercial subscription date and the installed certificate's expiry date in your records.
IN THIS ARTICLE
01 Understand the current validity limit
For publicly trusted TLS certificates issued from 15 March 2026 until before 15 March 2027, the CA/Browser Forum maximum validity is 200 days. The scheduled maximum falls to 100 days in March 2027 and 47 days in March 2029. A provider may issue a certificate for a shorter period. Multi-year service packages therefore rely on repeated issuance or replacement.
02 Prepare the renewal
- Check the certificate currently served by each public hostname. Include a CDN or load balancer and any separate origin service in your inventory.
- Identify whether renewal is automated by the hosting platform, handled by the CDN or requires action on a paid certificate service. Confirm the subscription remains active.
- Review the authorised names and validation method. Keep required DNS records, validation paths and contact access available for the method being used.
- Follow the product's renewal or reissue workflow. Generate a new request or key when required by the platform or a key-compromise response.
- Install the new certificate and complete chain at every relevant endpoint. Use the panel's supported process and reload the service only when necessary and authorised.
- Test the live connection again and record the newly presented expiry date and covered names.
03 Fix failed automation early
Common causes include a hostname pointing elsewhere, a blocked validation request, restrictive CAA records, an expired service or an unavailable DNS integration. Review the actual issuance error before changing settings. Repeated requests can trigger authority limits without correcting the cause.
What if the old certificate is still visible?
Check whether you updated the origin while visitors connect to a CDN, or updated only one server in a group. Compare the certificate for the exact hostname using a fresh connection. Do not tell customers to ignore browser warnings while investigating.
Use monitoring with sufficient lead time and a reachable recipient. Shorter certificate lifetimes make reliable automation and prompt failure alerts part of normal website maintenance.