How to renew your SSL certificate

Renewing a certificate means getting a new certificate for the same domain names, then installing it before the old one expires. The process depends mostly on how your certificate was obtained. Start by identifying your situation.

1. Find out who issues your certificate

Open the SSL checker or click the padlock in your browser, then look at the issuer:

• Let's Encrypt (issuers R10, R11, E5, E6…): a free 90-day certificate, normally renewed automatically by an ACME client such as Certbot.
• Your host or CDN (Cloudflare, OVHcloud, o2switch, Vercel…): renewal is handled by the platform. Your only job is to check that it actually happens.
• A commercial authority (Sectigo, DigiCert, GlobalSign…): renewal involves placing an order, completing validation, then installing it manually or through your control panel.

2. Let's Encrypt: check the automation

With Certbot, renewal is triggered by a scheduled task (systemd timer or cron). It only replaces the certificate when it's close to expiring. Check that the task exists and works:

# List certificates managed by Certbot and their expiration dates
sudo certbot certificates

# Simulate a full renewal without changing anything
sudo certbot renew --dry-run

# Check that the scheduled task is active (installed via apt/dnf)
systemctl list-timers | grep certbot

If the --dry-run fails, the real renewal will fail too. The most common causes: port 80 closed or redirected, webroot folder moved, DNS no longer pointing to this server. Our renewal assistant generates the right commands for your web server.

One last step that's often forgotten: reload the web server after renewal. Otherwise Nginx or Apache keeps serving the old certificate until the next restart.

sudo certbot renew --deploy-hook "systemctl reload nginx"

3. Commercial certificate: the steps

1. Generate a new private key and a CSR (Certificate Signing Request). Reusing the old key is possible, but a new key is better.

   openssl req -new -newkey rsa:2048 -nodes \
     -keyout example.com.key -out example.com.csr \
     -subj "/CN=example.com"
   

2. Order the renewal from your provider and paste in the CSR. Make sure to include every name you need (example.com and www.example.com).

3. Validate the domain: email to admin@, DNS TXT record or HTTP file, depending on the method you chose.

4. Download the certificate and the intermediates, then assemble them in the right order: your certificate first, then the intermediates.

5. Install them on the server, the load balancer or your host's control panel, then reload the service.

6. Check from the outside that the new expiration date is actually being served (see below).

Since March 2026, a commercial certificate can no longer be valid for more than 200 days. "Once a year" renewal is a thing of the past: plan for at least two renewals a year, and more starting in 2027.

4. When to renew?

• Let's Encrypt: Certbot renews automatically about 30 days before expiry. If fewer than 20 days remain, something is wrong.
• Commercial certificate: start the process 30 days before expiry. OV or EV validation can take several days, and the time left on the old certificate is usually no longer carried over to the new one.

5. Check that the new certificate is live

Renewal is only done when the server is serving the new certificate. Test from your machine:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

Or run the SSL checker again. If you have several servers behind a load balancer, or a CDN in front of your site, check every entry point.

Stop relying on your memory

An automatic renewal can fail for weeks without anyone noticing. And since June 2025, Let's Encrypt no longer sends emails before expiry. Add your domains to SSL Expiration Reminder: every certificate is checked automatically, and you get an alert 30, 15 or 7 days before expiry, depending on your settings. If a date doesn't change when it should have, you'll know in time.