# How to renew an SSL certificate in 2026: manual steps and automation

> Renew an SSL/TLS certificate step by step: check the expiry, create a new key and CSR, pass domain validation, install the full chain and automate renewals.

- URL: https://computese.com/ssl-certificate/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-06-21
- Updated: 2026-09-25
- Topics: Hosting, Security

## In short
- Renewing an SSL certificate means issuing a new one: generate a fresh key and CSR, prove domain control again, install the new certificate with its intermediate chain, then reload and verify the server.
- Public TLS certificates issued since March 15, 2026 are valid for at most 200 days. The CA/Browser Forum limit drops to 100 days in March 2027 and 47 days in March 2029.
- Wildcard certificates cannot be validated with a file on the website. DNS validation is the method that lasts: email-based validation is being phased out between March 2026 and March 2028.
- At these lifetimes, manual renewal stops scaling: use an ACME client or your platform's managed certificates, and monitor expiry separately from the thing that renews.

To renew an SSL certificate, you generate a new private key and certificate signing request (CSR), submit it to your certificate authority (CA), prove again that you control the domain, then install the new certificate and its intermediate chain and reload the web server. A renewal never extends the old file: it issues a new certificate with a new validity period, and the old one stops mattering once the new one is served.

That process used to happen once a year, so teams did it by hand and forgot how in between. That is changing. Public TLS certificates issued since March 15, 2026 last at most 200 days, and the limit keeps falling. This guide covers the manual steps for Nginx, Apache, IIS and hosting panels, the special cases (wildcard, multi-domain and Comodo, now Sectigo, certificates), and how to automate the whole thing so an expiry never takes your site down.

## What renewing an SSL certificate actually means

"SSL certificate" is the name everyone searches for, but the protocol it secures is TLS: SSL itself was retired years ago, and servers today negotiate TLS 1.2 or TLS 1.3. The certificate is what lets a browser trust the connection. It ties your domain name to a public key and carries a CA's signature and two dates, `notBefore` and `notAfter`. After `notAfter`, every mainstream client rejects it.

Renewal therefore means three things happen again:

- **A key pair is chosen.** Best practice is a fresh private key for every renewal, generated on the server that will use it.
- **Validation is repeated.** The CA confirms domain control, and for OV and EV certificates the organization as well, unless an earlier validation is still inside the allowed reuse period.
- **A new certificate is issued and installed.** Until the server presents it, nothing has changed for your visitors.

### Why certificate lifetimes keep getting shorter

In April 2025 the CA/Browser Forum, the body of CAs and browser makers that sets the rules for public certificates, passed [ballot SC-081](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/). It shrinks both how long a certificate may live and how long a CA may reuse an earlier domain validation:

| Certificate issued on or after | Maximum validity | Domain validation reuse |
| ------------------------------ | ---------------- | ----------------------- |
| Before March 15, 2026          | 398 days         | 398 days                |
| March 15, 2026                 | 200 days         | 200 days                |
| March 15, 2027                 | 100 days         | 100 days                |
| March 15, 2029                 | 47 days          | 10 days                 |

Shorter lifetimes limit how long a stolen key or a mis-issued certificate stays useful. The practical consequence is simpler: in 2029 a certificate renewed by hand needs attention roughly eight times a year, per certificate. Most teams will automate long before then, and the rest of this guide assumes you will.

## Check when your certificate expires

Before renewing, confirm what is actually deployed. The certificate your CA dashboard shows is not always the one your server, load balancer or CDN presents.

- **In a browser:** click the site-information icon beside the address, open the certificate details and read "Valid to" or "Expires".
- **From a terminal**, against the live server. The `-servername` flag matters on shared hosting, where one IP serves many certificates:

```bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates
```

- **From the file on disk**, useful before you swap files:

```bash
openssl x509 -in /etc/ssl/example.com/fullchain.pem -noout -enddate -ext subjectAltName
```

Write down every host name in the `subjectAltName` list. The renewed certificate has to cover all of them, or a subdomain that worked yesterday will break tomorrow.

> [!WARNING]
> Do not rely on your CA to remind you. [Let's Encrypt stopped sending expiration emails](https://letsencrypt.org/2025/01/22/ending-expiration-emails/) on June 4, 2025, and a reminder sent to a former employee's mailbox protects nobody. Use a monitoring check that connects to the site itself.

## The SSL certificate renewal process, step by step

For a certificate you manage yourself (a commercial DV, OV or EV certificate, or any certificate you upload by hand), the process is the same whichever CA sold it:

1. **List what the certificate must cover:** the exact host names, whether you need a wildcard, and the validation level (DV, OV or EV).
2. **Generate a new private key and CSR** on the server, or on a secure workstation if the key is going to a load balancer.
3. **Start the renewal with your CA** (sometimes called a "reissue" or "renew order"), paste the CSR and choose a validation method.
4. **Complete domain control validation** by publishing a DNS record, placing a file on the site or answering an approval email while that is still allowed.
5. **Download the issued certificate and the CA's intermediate chain.** Most CAs offer a "full chain" or "bundle" file.
6. **Install both on every server or service that terminates TLS** for those names, then reload, not only restart, the service.
7. **Verify from outside** that the new expiry date and the complete chain are served, then remove the old key and certificate from disk.

### Generate a new private key and CSR

OpenSSL is available on Linux and macOS and ships with Git for Windows. This creates a 2048-bit RSA key and a CSR for two names:

```bash
openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
```

For modern clients an ECDSA key (`-newkey ec -pkeyopt ec_paramgen_curve:prime256v1`) is smaller and faster; keep RSA if you still serve very old devices. Set the key file to be readable by the web server only (`chmod 600`), and never email a private key or paste it into a CA's web form. On Windows Server, IIS Manager's "Create Certificate Request" wizard builds the key and CSR inside the machine's certificate store instead. For keys and other secrets in application code, see [secure coding best practices](https://computese.com/best-practices-for-secure-coding/).

### Complete domain control validation

The CA will offer one or more of these methods. Pick the one you can repeat reliably, because at 47-day lifetimes you will be repeating it often.

| Method             | How you prove control                                                  | Good for                                     |
| ------------------ | ---------------------------------------------------------------------- | -------------------------------------------- |
| DNS record         | Publish a TXT or CNAME record the CA gives you                         | Wildcards, servers not reachable on port 80  |
| HTTP file          | Serve a token at `/.well-known/` (ACME `http-01` or the CA's own path) | Single sites with a public web server        |
| TLS-ALPN           | Answer a special TLS handshake on port 443 (ACME `tls-alpn-01`)        | Proxies and servers that only listen on 443  |
| Email to a contact | Click a link sent to admin@, webmaster@ or a DNS-listed contact        | Legacy workflows only (being retired, below) |

Email validation is on its way out. Under [the current Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/), the email methods "SHOULD NOT" be used from March 15, 2026 and CAs must stop relying on them from March 15, 2028. If your renewals still wait on someone clicking an email, move to DNS validation now. If validation fails even though the record is in place, check for a CAA record in your DNS: it lists the only CAs allowed to issue for your domain.

## Install the renewed certificate on your server

Install the leaf certificate together with its intermediates. A missing intermediate is the most common renewal mistake: desktop browsers often paper over it, while Android apps, API clients and payment providers refuse the connection.

![A server sends a laptop and a phone two linked certificate cards, its own and the intermediate, while the root certificate is already stored inside each device.](https://computese.com/images/blog/ssl-certificate/chain.bcad172563-1536.webp)

*Send the intermediate with your certificate: the root is already on the visitor's device, the intermediate is not.*

### Nginx

Put [the server certificate first](https://nginx.org/en/docs/http/ngx_http_ssl_module.html) and the intermediates after it in one file, then point `ssl_certificate` at it:

```nginx
server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate     /etc/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com/privkey.pem;
}
```

Test and reload with `sudo nginx -t && sudo systemctl reload nginx`. A reload picks up the new files without dropping open connections.

### Apache HTTP Server

Since [Apache 2.4.8](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html), `SSLCertificateFile` can hold the certificate followed by its intermediates, which makes the old `SSLCertificateChainFile` directive obsolete:

```apache
<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/ssl/example.com/privkey.pem
</VirtualHost>
```

Run `apachectl configtest`, then `sudo systemctl reload apache2` (or `httpd` on Red Hat family systems).

### IIS on Windows Server

In IIS Manager, open **Server Certificates** and choose **Complete Certificate Request** (if you created the CSR there) or **Import** for a PFX file. Then open each site's **Bindings**, edit the `https` binding and select the new certificate. Check every binding that used the old one, including other sites sharing the same IP with SNI.

### cPanel, Plesk and managed hosting

Hosting panels usually issue free DV certificates automatically (cPanel's AutoSSL, Plesk's Let's Encrypt extension). Those renew on their own as long as the domain still points at the host. For a certificate you bought elsewhere, open **SSL/TLS**, install the new certificate, key and CA bundle for the domain, and remove the expired entry so the panel does not keep serving it.

### Load balancers, CDNs and cloud platforms

If traffic passes through a CDN or load balancer, that is where the certificate your visitors see lives, and replacing the file on the origin changes nothing for them.

![A laptop and a phone connect over padlocked lines to a load balancer that holds an orange certificate card, which passes the traffic on to three servers in a private network.](https://computese.com/images/blog/ssl-certificate/edge.237ffa70fb-1536.webp)

*TLS usually ends at the edge: a load balancer or CDN. Renew and install the certificate where connections actually terminate.*

- **AWS Certificate Manager** [renews Amazon-issued certificates automatically](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html) when they use DNS validation and are in use by a service such as Elastic Load Balancing or CloudFront. Imported certificates are not renewed: you re-import the new one.
- **Cloudflare** renews its own edge certificates. A custom certificate you uploaded must be replaced before it expires, and the origin certificate behind Cloudflare has its own expiry date.
- **Azure App Service, Google Cloud load balancers and Kubernetes ingresses** each offer managed certificates. When you bring your own, the renewal is a new upload or a new secret, followed by checking which listener uses it.

## Renewing a wildcard or multi-domain certificate

A wildcard certificate for `*.example.com` covers `shop.example.com` and `mail.example.com`, but not `example.com` itself (add it as a second name) and not `a.b.example.com`. Wildcards cannot be validated with a file on the website: the CA has to check DNS, or a contact published for the domain while email and phone methods are still allowed. So a wildcard renewal is the moment to move the domain to a DNS provider with an API your ACME client can drive.

Multi-domain certificates (also sold as SAN or UCC certificates) list each name explicitly. At renewal, compare the SAN list from your check above with what the CA will issue. Names you drop disappear from the new certificate; names you add need their own validation.

One more wildcard consideration: the same private key installed on dozens of servers is a large blast radius. With automation in place, per-service certificates are often the safer design.

## Renewing a Comodo (now Sectigo) certificate

[Comodo CA rebranded as Sectigo](https://sectigo.com/resource-library/comodo-ca-rebrands-as-sectigo) on November 1, 2018, and "Comodo" certificates bought through resellers are issued by Sectigo today. Renewal follows the same process: generate a new CSR, start the renewal in the Sectigo or reseller account, complete validation and install the certificate together with the Sectigo intermediate bundle the email or portal provides. If the reseller account has lapsed, a new order with any CA works just as well; nothing ties the domain to the CA it used before, unless a CAA record says so.

## Automate SSL certificate renewal with ACME

ACME, standardized as [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555.html), is how most certificates on the web are now renewed: a client on your server requests a certificate, answers the validation challenge and installs the result, on a schedule, without anyone logging in. Let's Encrypt is free and ACME-only, and several commercial CAs and cloud platforms offer ACME endpoints too.

Common clients:

- **Certbot** (EFF) for Apache and Nginx on Linux. Most installs add a scheduled `certbot renew`; test it with `sudo certbot renew --dry-run`. Since [Certbot 4.0](https://eff-certbot.readthedocs.io/en/stable/using.html) a certificate is due once less than a third of its lifetime remains.
- **acme.sh**, a shell-only client with DNS API plugins for many providers, handy for wildcards.
- **Caddy** and **Traefik**, web servers and proxies that obtain and renew certificates by themselves.
- **cert-manager** for Kubernetes, which stores certificates as secrets and renews them before expiry.
- **win-acme** for IIS on Windows Server.

Three habits make automation dependable:

1. **Renew early.** [Let's Encrypt recommends](https://letsencrypt.org/docs/integration-guide/) renewing with a third of the lifetime left, and checking ACME Renewal Information (ARI, [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773.html)) at least twice a day so the CA can ask you to renew sooner, for example before a revocation.
2. **Reload after renewing.** A new file on disk is not a new certificate in memory. Use a deploy hook (`certbot renew --deploy-hook "systemctl reload nginx"`) so the server picks it up.
3. **Monitor separately.** Alert on the expiry date seen from outside, not on the renewal job's exit code. A job can succeed while a load balancer keeps serving the old certificate.

Let's Encrypt is also shortening its own certificates. Its [default "classic" profile](https://letsencrypt.org/docs/profiles/) issues 90-day certificates today; an opt-in 45-day `tlsserver` profile started on May 13, 2026, [the default moves to 64 days](https://letsencrypt.org/2025/12/02/from-90-to-45/) on February 10, 2027, and to 45 days on February 16, 2028. A client that renews on a fixed 60-day timer will break at that point, which is one more reason to rely on ARI or the one-third rule.

## Verify the renewal worked

After installing, check from outside your network:

- `openssl s_client` (as above) shows the new `notAfter` date and the right issuer.
- The chain is complete: `openssl s_client -connect example.com:443 -servername example.com -showcerts` should list your certificate followed by its intermediate.
- Every host name on the certificate answers with the new certificate, including `www` and API subdomains.
- An external test such as Qualys SSL Labs reports no chain issues and only TLS 1.2 and 1.3 enabled.
- Anything that pins or caches certificates (mobile apps, partners' firewalls, payment gateways) still connects.

## Common SSL renewal errors and how to fix them

| Symptom after renewing                           | Likely cause                                                                | Fix                                                              |
| ------------------------------------------------ | --------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| Browsers still show the old expiry date          | The service was not reloaded, or a CDN or load balancer serves its own copy | Reload the service; install the certificate where TLS terminates |
| "Unable to get local issuer certificate" in apps | Intermediate certificate missing                                            | Serve the full chain file, leaf first                            |
| Server refuses to start: key values mismatch     | The certificate was issued for a different CSR and key                      | Install the key generated with this CSR, or reissue              |
| Validation keeps failing                         | Wrong DNS record, DNS not yet propagated, or a CAA record blocks the CA     | Check the record with `dig TXT`, wait for TTL, update CAA        |
| Some subdomains show a name-mismatch error       | The new certificate dropped a SAN                                           | Reissue with the complete list of names                          |
| Mixed-content warnings after renewal             | Pages load images or scripts over `http://`                                 | Serve every asset over HTTPS; the certificate is not the problem |

If renewals keep landing on someone's calendar, that is the real problem to fix. Our [hosting and maintenance service](https://computese.com/services/hosting-maintenance/) runs certificate automation and external expiry monitoring as part of looking after a site, and our [security scanning](https://computese.com/services/security-testing/) flags weak TLS settings along with the rest of your exposed surface. HTTPS is also your first defence against [eavesdropping attacks](https://computese.com/understanding-eavesdropping-attacks-how-they-work/), which is why an expired certificate is more than a cosmetic warning. The certificate is one item on a longer list; our [website security checklist](https://computese.com/essential-tips-to-secure-your-website/) covers the rest.

## Key terms
- **SSL/TLS certificate**: A file that binds a domain name to a public key, signed by a certificate authority. Browsers call it SSL out of habit; the protocol in use today is TLS 1.2 or 1.3.
- **Certificate authority (CA)**: An organization browsers trust to issue certificates, such as Let's Encrypt, Sectigo, DigiCert or GlobalSign.
- **CSR (certificate signing request)**: The request you send to the CA. It carries your public key and the names to cover, and is signed with the matching private key, which never leaves your server.
- **Domain control validation (DCV)**: The CA's check that you control the domain, done with a DNS record, a file on the website or, for now, an email to a domain contact.
- **Intermediate certificate**: The CA certificate that links your certificate to a trusted root. Servers must send it with the leaf certificate, or some clients fail to connect.
- **SAN (Subject Alternative Name)**: The list of host names a certificate covers. A multi-domain or UCC certificate is one certificate with several SANs.
- **Wildcard certificate**: A certificate for *.example.com that covers every first-level subdomain, but not the bare domain or deeper levels unless they are listed too.
- **ACME**: The Automatic Certificate Management Environment protocol (RFC 8555) that tools like certbot use to request, validate and renew certificates without a person in the loop.
- **ARI (ACME Renewal Information)**: An ACME extension (RFC 9773) that lets the CA tell your client when to renew, for example ahead of a mass revocation.

## Common questions

### How long does it take to renew an SSL certificate?

A domain-validated (DV) certificate is usually issued within minutes of the validation record or file being in place. Organization-validated (OV) and extended-validation (EV) certificates take longer, often one to several business days, because the CA also checks the company behind the domain.

### Can I renew an SSL certificate before it expires?

Yes, and you should: renewing with about a third of the lifetime left gives you time to fix a failed validation. Whether a commercial CA carries unused days over depends on the CA, and a renewal can never exceed the current maximum validity period.

### Do I need a new CSR to renew an SSL certificate?

Treat it as yes. A new CSR with a new private key limits the damage if the old key was ever exposed. Some CAs accept the previous CSR, but reusing a key for years is exactly what shorter lifetimes are meant to end.

### What happens if my SSL certificate expires?

Browsers show a full-page warning (in Chrome, NET::ERR_CERT_DATE_INVALID), visitors on sites with HSTS cannot click past it, and APIs, payment callbacks and mobile apps that call your server fail the TLS handshake outright. Renewing and reloading the server fixes it immediately.

### Is a free Let's Encrypt certificate as secure as a paid one?

The encryption is the same. Paid certificates add organization validation, support, warranties and longer lifetimes; free ACME certificates are domain-validated, shorter-lived and designed to be renewed by software.

### How do I renew SSL on cPanel, Cloudflare or a managed host?

Managed certificates (cPanel AutoSSL, Cloudflare Universal SSL, AWS Certificate Manager with DNS validation) renew themselves while validation keeps passing. A certificate you uploaded yourself does not: you renew it with the CA and upload the new files.

## Sources
1. [Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates](https://cabforum.org/working-groups/server/baseline-requirements/), CA/Browser Forum
2. [Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/), CA/Browser Forum
3. [Decreasing Certificate Lifetimes to 45 Days](https://letsencrypt.org/2025/12/02/from-90-to-45/), Let's Encrypt
4. [Ending Support for Expiration Notification Emails](https://letsencrypt.org/2025/01/22/ending-expiration-emails/), Let's Encrypt
5. [Profiles](https://letsencrypt.org/docs/profiles/), Let's Encrypt
6. [Integration Guide](https://letsencrypt.org/docs/integration-guide/), Let's Encrypt
7. [RFC 8555: Automatic Certificate Management Environment (ACME)](https://www.rfc-editor.org/rfc/rfc8555.html), IETF
8. [RFC 9773: ACME Renewal Information (ARI) Extension](https://www.rfc-editor.org/rfc/rfc9773.html), IETF
9. [User Guide: Renewing certificates](https://eff-certbot.readthedocs.io/en/stable/using.html), EFF Certbot
10. [Apache Module mod_ssl](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html), Apache HTTP Server Project
11. [Module ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html), nginx
12. [Managed certificate renewal in AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html), Amazon Web Services
13. [Comodo CA Rebrands as Sectigo](https://sectigo.com/resource-library/comodo-ca-rebrands-as-sectigo), Sectigo