How to Renew an SSL Certificate (2026 Guide) | FortifyNet

How to Renew an SSL Certificate: Step-by-Step Guide for 2026

To renew an SSL certificate, you generate a fresh certificate for the same domain before the old one expires, install it on your server or platform, and confirm the new expiry date. If you use Let's Encrypt, one command (certbot renew) does all of it and a timer runs it for you twice a day. If you bought a certificate from a commercial CA, you create a new CSR, complete domain validation again, download the new files and swap them in. This guide covers both paths, plus hosting panels and CDNs, and shows how to verify the renewal worked.

The stakes are rising. Since 15 March 2026 no public CA may issue a certificate valid for more than 200 days, and the cap drops to 47 days in 2029 (CA/Browser Forum ballot SC-081v3, approved April 2025). Renewal is no longer a once-a-year chore. It is becoming a continuous process, and the only realistic way to keep up is automation.

Why SSL certificate renewal matters more in 2026

An expired certificate does not degrade gracefully. Browsers block the page with a full-screen warning (NET::ERR_CERT_DATE_INVALID in Chrome), API clients fail their TLS handshake, and email and monitoring integrations start throwing errors. A single forgotten renewal took down Microsoft Teams for roughly three hours on 3 February 2020 (TechCrunch), and an expired certificate in Ericsson equipment knocked out mobile data for millions of O2 and SoftBank customers on 6 December 2018 (The Register).

Shorter lifetimes multiply the number of renewals you have to get right. The table below shows the industry schedule that every public CA must follow.

Effective date	Maximum certificate validity	Maximum domain-validation reuse	Source
Before 15 March 2026	398 days	398 days	CA/B Forum Baseline Requirements
15 March 2026 (in force now)	200 days	200 days	SC-081v3
15 March 2027	100 days	100 days	SC-081v3
15 March 2029	47 days	10 days	SC-081v3

Let's Encrypt, which reported serving more than 700 million websites and issuing over ten million certificates on a single day in late 2025 (Let's Encrypt, 9 December 2025), is moving faster than the mandate: its default profile switches from 90-day to 64-day certificates on 10 February 2027 and to 45-day certificates on 16 February 2028 (Let's Encrypt, 2 December 2025).

Renewals per year for one certificate at each maximum lifetime (365 divided by the lifetime in days). Sources: CA/Browser Forum SC-081v3; Let's Encrypt, 2 December 2025. A site with ten certificates on 47-day lifetimes needs about 78 successful renewals a year.

Step 1: Find out how your certificate was issued

The renewal method depends entirely on where the certificate came from. Run this on the server to see the issuer and expiry date:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -dates

The issuer line tells you which path to follow.

Issuer shown	Typical setup	How you renew
Let's Encrypt (R10, R11, E5, E6 etc.)	Certbot, acme.sh, Caddy, Traefik	Automated via ACME; check the timer, never renew by hand
DigiCert, Sectigo, GlobalSign, GoDaddy	Purchased DV/OV/EV certificate	New CSR, re-validate domain, install new files
cPanel, Inc. or Sectigo via AutoSSL	Shared hosting with cPanel	Automatic; check the SSL/TLS Status page
Cloudflare, Google Trust Services, Amazon	CDN or cloud edge certificate	Managed by the platform; confirm DNS or CNAME validation still resolves
Your own company name	Internal CA	Reissue from your PKI; not covered here

Step 2a: Renew a Let's Encrypt certificate with Certbot

Let's Encrypt certificates are valid for 90 days today and Certbot's packaged timer tries to renew them twice a day, renewing only when fewer than 30 days remain (Certbot documentation). If a site is showing an expired Let's Encrypt certificate, the automation has been failing for at least a month.

First list what Certbot knows about:

sudo certbot certificates

Then test a renewal without touching anything:

sudo certbot renew --dry-run

If the dry run passes, run the real renewal and reload your web server:

sudo certbot renew
sudo systemctl reload nginx

Certbot will say "Cert not yet due for renewal" if more than 30 days remain; that is normal. To renew early regardless (for example after changing the key size), add --force-renewal to a single certificate with certbot renew --cert-name example.com --force-renewal, but never leave it in a cron job, because Let's Encrypt rate-limits duplicate certificates to 5 per week.

Check that the timer is active so this keeps happening without you:

systemctl list-timers | grep certbot

Two changes since 2025 matter here. Let's Encrypt stopped sending expiry-warning emails on 4 June 2025 and deleted the addresses it held (Let's Encrypt, 26 June 2025), so nobody will nudge you. And modern ACME clients can ask the CA for a suggested renewal window through ACME Renewal Information (ARI, RFC 9773), which Certbot uses from version 2.9 onward. Keep the client updated so that it follows ARI rather than a hard-coded interval; Let's Encrypt explicitly warns that renewing at a fixed 60 days will not survive the move to 45-day certificates.

Step 2b: Renew a purchased certificate (DigiCert, Sectigo, GoDaddy and others)

Commercial certificates cannot be "extended". Renewal means the CA issues a brand-new certificate, so the process mirrors the original order.

1. Generate a new private key and CSR on the server. Reusing the old key is allowed but weakens the security benefit of renewing.

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr -subj "/CN=example.com"

1. Submit the CSR in the CA portal under Renew or Reissue. Most CAs let you start 30 to 90 days early and carry the remaining days over.
2. Complete domain validation again. Since 15 March 2026 a validation can only be reused for 200 days, so expect an email, HTTP file or DNS TXT challenge on almost every renewal. OV and EV certificates also need organisation checks; start those two weeks ahead.
3. Download the certificate and the intermediate chain. Missing intermediates cause ERR_CERT_AUTHORITY_INVALID on some devices even when the leaf certificate is fine.
4. Install and reload. Replace the certificate and chain files referenced in your server config, keep the new key alongside, and reload the service. On nginx that is ssl_certificate and ssl_certificate_key; on Apache, SSLCertificateFile and SSLCertificateKeyFile.
5. Update every copy. Load balancers, mail servers, CDN origins and monitoring probes often hold their own copy of the same certificate.

Step 2c: Renew on hosting panels, CDNs and cloud platforms

Platform	What renews it	What can break renewal	Where to check
cPanel AutoSSL	Daily cron on the host	Domain not pointing at the server, .htaccess blocking /.well-known/	SSL/TLS Status in cPanel
Plesk (Let's Encrypt extension)	Built-in scheduled task	Same as above; expired domain	Websites and Domains, SSL/TLS Certificates
Cloudflare Universal SSL	Cloudflare, automatically	Proxy turned off (grey cloud); CAA record excluding Cloudflare's CAs	SSL/TLS, Edge Certificates
AWS Certificate Manager	ACM, automatically for DNS-validated certs	Validation CNAME removed from Route 53	ACM console, certificate status
Kubernetes cert-manager	Controller, renews at two thirds of lifetime by default	Ingress class mismatch; solver pod cannot be reached	kubectl describe certificate
Caddy / Traefik	Built-in ACME client	Port 80 or 443 unreachable from the internet	Server logs

Step 3: Verify the renewal actually worked

Renewing and deploying are two different things. A renewed file sitting on disk does nothing until the server process has loaded it. Confirm from the outside:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate -serial

The notAfter date must be the new one and the serial number must differ from the old certificate. Then check the full chain and every host name (www and bare domain, API subdomains, mail hosts). A free FortifyNet scan checks the chain, expiry date, protocol versions and HSTS in one pass, which is faster than testing each host by hand.

Common SSL renewal errors and fixes

Error or symptom	Likely cause	Fix
Certbot: "Some challenges have failed" (HTTP-01)	Port 80 blocked, redirect loop, or DNS pointing elsewhere	Allow port 80 inbound, keep /.well-known/acme-challenge/ reachable over plain HTTP
Certbot: "too many certificates already issued"	Forced renewals in a loop	Remove --force-renewal from scheduled jobs, wait for the weekly window
DNS-01 "no TXT record found"	Propagation delay or wrong zone	Add a propagation wait, confirm the API token has zone edit rights
Browser still shows the old expiry after renewal	Service not reloaded, or CDN caching the old cert	Reload nginx/Apache; purge or re-upload at the CDN
ERR_CERT_AUTHORITY_INVALID after install	Intermediate chain missing	Install the full chain file the CA provides, not only the leaf
Certificate renewed but mail clients complain	Mail server uses its own copy	Deploy the same files to Postfix/Dovecot/Exchange and restart
CAA lookup failure	CAA record lists other CAs only	Add 0 issue "letsencrypt.org" (or your CA) to the CAA record

Set a renewal policy you can actually keep

With 200-day certificates now and 47-day certificates by 2029, a renewal policy should be boring and automatic. Renew at roughly two thirds of the certificate's lifetime, exactly the behaviour Let's Encrypt recommends for clients that lack ARI. Run a monitoring check that alerts at 14 and 7 days before expiry, independent of the renewal tool, because the failure you need to catch is the automation silently stopping. Keep an inventory of every host name that terminates TLS, including internal ones. And test the dry run after every server migration, PHP upgrade or firewall change, since those are the moments the ACME challenge stops working.

Related guides

• What happens when an SSL certificate expires
• SSL/TLS certificate security: the complete guide
• Fixing "Your connection is not private"
• What is HSTS and why it matters after a renewal

FAQ

How early can I renew an SSL certificate?
Let's Encrypt allows renewal at any time, and Certbot does it automatically 30 days before expiry. Commercial CAs typically open renewal 30 to 90 days early and add the unused days to the new certificate.

Does renewing an SSL certificate cause downtime?
No, if you reload rather than restart the web server. nginx and Apache both load the new certificate on a reload without dropping existing connections.

Do I need a new private key to renew?
Not strictly, but generating a new key is best practice. Certbot creates a new key on every renewal by default.

Can I renew a certificate after it has expired?
Yes. Renewal after expiry works the same way; the only difference is that visitors see warnings until the new certificate is installed.

How many times a year will I have to renew from 2029?
With the 47-day maximum, about eight times per certificate per year, which is why manual renewal is being phased out in practice.

Check your certificate before it becomes an incident

Run the free FortifyNet scan on your domain. In about 60 seconds it reports the certificate expiry date, chain validity, protocol versions, security headers, DNS and email authentication, so a failed renewal shows up before your visitors find it.

Originally published at fortifynet.com/blog/how-to-renew-ssl-certificate. I'm the founder of FortifyNet, a website security scanner; this article comes from our blog, so factor in that founder bias when you read any tool recommendations here.