SSL Certificate Renewal in 2026

SSL Certificate Renewal is the process of obtaining and deploying a replacement certificate before the certificate currently used by a website expires. The important part is not only completing the renewal with your certificate provider, but also confirming that the renewed certificate is actually being served by the public hostname.

In 2026, certificate management is becoming more frequent. The CA/Browser Forum's current Baseline Requirements limit publicly trusted subscriber certificates issued from March 15, 2026 to March 14, 2027 to a maximum validity period of 200 days. That limit is scheduled to fall to 100 days from March 15, 2027 and 47 days from March 15, 2029.

That makes a reliable renewal and verification process more important for website owners, developers, agencies, and IT teams.

What Is SSL Certificate Renewal?

An SSL certificate, more accurately a TLS certificate for modern HTTPS connections, contains a defined validity period. Its expiration date is part of the certificate itself, so you cannot simply edit the old certificate and move its expiry date forward. A renewal normally results in a new certificate that must be issued and deployed.

The exact renewal process depends on your certificate authority, hosting provider, CDN, control panel, or certificate-management system. A typical process involves:

Checking the current certificate and its expiration date.
Starting a renewal or replacement request.
Completing any required domain or organization validation.
Providing or generating a CSR when required.
Receiving the replacement certificate.
Installing or deploying the new certificate.
Verifying the live website after deployment.

For example, Namecheap documents renewal as purchase, activation, validation, and installation. DigiCert's current workflow also includes renewal, CSR generation, validation, and certificate deployment.

Why SSL Certificate Renewal Matters in 2026

The biggest change to understand is the move toward shorter certificate lifetimes.

Under the current CA/Browser Forum requirements, publicly trusted subscriber certificates have these maximum validity periods:

Certificate issued	Maximum validity
Before March 15, 2026	398 days
March 15, 2026 to March 14, 2027	200 days
March 15, 2027 to March 14, 2029	100 days
From March 15, 2029	47 days

These are maximum periods under the industry requirements. A certificate authority can issue a certificate for a shorter period. For example, DigiCert currently documents a 199-day maximum for its public TLS/SSL certificates, while Let's Encrypt continues to issue certificates with a 90-day default lifetime.

Shorter lifetimes mean certificate management needs to become more consistent. Automated renewal can reduce manual work, but it does not remove the need to monitor whether renewals actually succeeded and whether the new certificate was deployed correctly. DigiCert specifically recommends automated renewal and replacement as certificate lifetimes become shorter.

When Should You Renew an SSL Certificate?

There is no universal renewal date that applies to every certificate and provider. Renewal windows, automation schedules, validation requirements, and deployment processes vary.

You should start preparing before the current certificate expires, especially for an important production website.

Review your certificate when:

The expiration date is approaching.
Your certificate provider sends a renewal notification.
Automatic renewal reports a failure.
You are moving the website to another host.
You are changing DNS, CDN, proxy, or load-balancer configuration.
You are replacing or reconfiguring a web server.
A new subdomain is being added.
You need to confirm that a recently renewed certificate is live.

For example, Namecheap currently makes its standard renewal option available within 30 days of expiration, while its early-renewal options can differ depending on the services involved. DigiCert allows renewal earlier in its certificate lifecycle and documents its own renewal rules.

The practical lesson is simple: follow your provider's renewal window rather than relying on a generic number of days.

How to Renew an SSL Certificate

1. Check the current certificate

Start by identifying the exact hostname you need to renew.

For example:

example.com

www.example.com

shop.example.com

These are different hostnames, and a certificate configuration that works for one does not automatically mean every hostname is covered correctly.

Before renewing, you can review the certificate currently being served by a public hostname with the ConvixPro SSL Certificate Checker. It shows supported certificate information such as certificate status, validity dates, expiration information, remaining validity when available, and connection or certificate errors.

2. Confirm the certificate and hostnames

Check which certificate is expiring and which names it covers.

This is particularly important when a website has several subdomains, multiple environments, or infrastructure spread across a CDN, reverse proxy, or load balancer.

Do not assume that renewing one certificate automatically updates every certificate used by the website.

3. Start the renewal process

Use the certificate-management system supplied by your Certificate Authority, hosting company, CDN, control panel, or ACME client.

The terminology can vary. Some providers call this renewal, while others may describe parts of the process as replacement or reissuance.

4. Complete certificate validation

The Certificate Authority may need to confirm that you control the domain.

Domain Control Validation, or DCV, can use methods such as DNS records, HTTP file validation, or email, depending on the certificate authority and certificate type. Namecheap currently documents CNAME, file-upload, and email-based DCV methods for its renewal process.

For organization-validated certificates, additional organization checks may apply.

5. Generate or provide a CSR when required

A Certificate Signing Request, or CSR, contains information used when requesting a certificate and is tied to a key pair.

Do not assume that every renewal requires a brand-new CSR. The requirement depends on the provider and renewal workflow. DigiCert currently requires a new CSR for its documented renewal process, while Cloudflare's custom-certificate documentation states that a previously generated CSR can be reused in its workflow.

Follow the specific instructions for your certificate platform.

6. Receive the replacement certificate

Once validation and issuance are complete, download or retrieve the new certificate according to the provider's instructions.

Keep the required certificate files and private key protected. Never publish private keys or include them in a public tool input.

7. Install the new certificate

Install the replacement certificate on the server or platform that actually handles HTTPS traffic.

Depending on your infrastructure, that could be:

A web server
A reverse proxy
A load balancer
A CDN
A hosting control panel
Another certificate-management platform

A certificate can be successfully issued while the production website continues serving the old certificate if deployment was incomplete.

8. Verify the live certificate

This final step is easy to overlook.

Do not treat the renewal as finished just because your provider says the certificate was issued.

Check the actual public hostname again and review the certificate information being served.

How to Verify an SSL Certificate After Renewal

After installing the replacement certificate, verify the live website rather than checking only the certificate-management dashboard.

Use this simple process:

Enter the exact public hostname.
Run the SSL certificate check.
Confirm that a certificate was detected.
Review the reported certificate status.
Check the expiration date.
Review remaining validity when available.
Investigate any certificate or connection errors.

The ConvixPro SSL Certificate Checker is designed for this type of public-domain check. The tool's documented output includes certificate detection, status, valid-from date, expiration date, remaining time when available, and connection or certificate errors.

This verification step is particularly useful after renewal because the certificate provider's internal record and the certificate actually presented by the public website are not necessarily the same thing.

Why Is My Website Still Showing the Old SSL Certificate?

If your certificate was renewed but a check still shows the previous expiration date, the new certificate may not be serving from every relevant endpoint.

Common situations include:

CDN deployment

Your origin server may have the new certificate while the CDN is still serving another certificate.

Load balancer configuration

A load balancer can terminate HTTPS before traffic reaches the application server. The certificate installed on the backend server may therefore not be the certificate visitors receive.

Multiple web servers

One server may have the replacement certificate while another still has the old one.

Reverse proxy configuration

A reverse proxy may handle the public HTTPS connection separately from the application server.

IPv4 and IPv6 differences

Different network paths can sometimes expose different infrastructure configurations.

If the old certificate remains visible, check the exact hostname again and inspect each relevant endpoint in your infrastructure.

Common SSL Certificate Renewal Problems

Automatic renewal failed

Automatic renewal reduces manual work, but it can still fail because validation, DNS, account, configuration, or deployment conditions were not satisfied. DigiCert and Cloudflare both document automated renewal workflows and failure conditions that need attention.

Check the renewal logs or provider notifications first. Then investigate the specific validation or deployment error rather than repeatedly triggering the same renewal operation.

Domain validation failed

A DCV failure can occur when the required DNS record, validation file, or email verification step cannot be completed.

Check the validation instructions from your Certificate Authority and confirm that the correct domain is being validated.

The wrong hostname was renewed

Make sure the renewed certificate covers the hostname visitors actually use.

For example, renewing a certificate for example.com does not by itself prove that login.example.com is configured correctly.

The new certificate was issued but not installed

Certificate issuance and certificate deployment are separate steps.

Confirm that the new certificate is installed on the service handling public HTTPS traffic.

The CDN or proxy still serves the old certificate

Check the public hostname after deployment. If it still reports the previous expiration date, review your CDN, reverse-proxy, or load-balancer configuration.

A new CSR was created incorrectly

If your provider requires a CSR, make sure it was generated for the correct hostname and key pair. Follow the provider's current CSR instructions rather than assuming the requirements are identical across Certificate Authorities.

SSL Certificate Renewal vs. SSL Certificate Expiration

These two terms describe different parts of the certificate lifecycle.

SSL certificate expiration is the point at which the certificate's defined validity period ends.

SSL certificate renewal is the process of obtaining and deploying a replacement certificate before the current one expires.

A website owner should ideally check the current expiration date first, then begin renewal early enough to deal with validation or installation problems.

For more methods of checking expiration dates, see the ConvixPro guide on checking SSL certificate expiration.

SSL Certificate Auto Renewal: What You Should Know

Automatic renewal can be especially useful as certificate lifetimes become shorter.

Let's Encrypt has long used 90-day certificates and recommends automation. In February 2026, Let's Encrypt announced a staged move from 90-day default certificates toward 64-day and eventually 45-day certificates, with ACME clients that support ARI able to automate the timing.

DigiCert also emphasizes automated renewal and replacement as a way to reduce manual intervention and maintain certificate coverage.

However, automatic renewal should not mean “set it and forget it.”

A good workflow still includes:

Renewal monitoring
Failure alerts
Correct DNS and validation configuration
Deployment verification
Checking important public hostnames after infrastructure changes

Automation handles repetitive certificate-management work. Verification helps confirm that the expected certificate is actually live.

SSL Certificate Renewal Checklist

Before renewal

Check the current certificate expiration date.
Confirm the exact hostname or hostnames.
Identify the certificate provider or management system.
Review the provider's renewal requirements.
Check whether automatic renewal is configured.
Confirm the required validation method.

During renewal

Start the renewal or replacement request.
Complete required domain validation.
Generate or provide a CSR if required.
Confirm certificate details before deployment.
Protect private keys and certificate-management credentials.

After renewal

Install the new certificate on the production endpoint.
Update the CDN, proxy, or load balancer when applicable.
Check the public hostname.
Confirm the new expiration date.
Check important subdomains.
Investigate any remaining certificate errors.
Open the website through HTTPS and confirm there is no unexpected browser warning.

What Happens If an SSL Certificate Expires?

An expired certificate is outside its stated validity period. Browsers and other TLS clients may reject it or display a certificate warning, which can interrupt normal HTTPS access. The practical effect depends on the browser, application, service, and configuration involved.

If a certificate has already expired, identify the affected hostname, renew or replace the certificate, deploy it to the correct endpoint, and verify the live certificate afterward.

Do not assume that fixing the certificate in your provider dashboard automatically fixes every public endpoint.

Conclusion

A successful SSL Certificate Renewal involves more than obtaining a replacement certificate. You need to confirm the correct hostname, complete any required validation, deploy the new certificate to the service handling HTTPS traffic, and verify the live result afterward.

As certificate lifetimes become shorter, consistent renewal and monitoring become increasingly important. A simple final certificate check can help confirm that the public hostname is serving the expected certificate and expiration information.

After renewing your certificate, check your SSL certificate with the free ConvixPro to review its current status, validity information, and expiration details.

Frequently Asked Questions

What is SSL certificate renewal?

SSL certificate renewal is the process of obtaining and deploying a replacement certificate before the current certificate expires. The exact process varies by certificate authority, hosting provider, CDN, or certificate-management system.

When should I renew my SSL certificate?

Start before the certificate reaches its expiration date and follow your provider's renewal window. The appropriate timing depends on the certificate type and management system, especially as certificate validity periods become shorter.

Does renewing an SSL certificate extend the old certificate?

No. A certificate's validity dates are part of the certificate itself. Renewal generally involves issuing a new certificate rather than editing the expiration date of the existing certificate.

Do SSL certificates renew automatically?

Some providers and certificate-management systems support automatic renewal. Let's Encrypt and DigiCert both encourage automation for managing shorter certificate lifetimes. Automatic renewal should still be monitored because validation or deployment can fail.

Do I need a new CSR when renewing an SSL certificate?

Not always. CSR requirements depend on the provider and renewal workflow. DigiCert currently requires a new CSR for its documented renewal process, while Cloudflare documents cases where a previously generated CSR can be reused.

Why is my website still showing the old certificate after renewal?

The new certificate may not have been deployed to the endpoint serving public HTTPS traffic. Check your CDN, reverse proxy, load balancer, multiple servers, and other relevant endpoints, then verify the exact public hostname again.

How can I check my SSL certificate expiration date?

You can inspect the certificate in a browser, use command-line tools such as OpenSSL, or use an online SSL certificate checker. The ConvixPro SSL Certificate Checker lets you review the expiration information returned for a public hostname.

Can a certificate be unexpired but still cause an HTTPS error?

Yes. Expiration is only one part of certificate and HTTPS validation. Problems can also involve hostname coverage, certificate trust, missing intermediate certificates, deployment, or other TLS configuration issues.

SSL Certificate Renewal in 2026 | Checklist & Steps