Renew SSL Certificate: Auto-Renew and Paid Cert Steps

Q: How do I renew a Let's Encrypt certificate?

Run `sudo certbot renew`. It only renews certificates that are close to expiry, so it is safe to run on a schedule. Most Certbot installs already come with a scheduled task that does this, and `sudo certbot renew --dry-run` tests the process against Let's Encrypt's staging server without saving the test certificates.

Q: How long is an SSL certificate valid in 2026?

Under CA/Browser Forum ballot SC-081v3, publicly trusted certificates were capped at 398 days until March 15, 2026. Since that date the cap is 200 days. It drops to 100 days on March 15, 2027 and to 47 days on March 15, 2029. Some certificate authorities issue slightly under the cap, and Let's Encrypt has its own shorter schedule.

Q: What happens if my SSL certificate expires?

Browsers show a full-page security warning to visitors, and many will refuse to continue without a manual override. API clients and payment or login integrations that validate certificates strictly can fail outright. Renewing and installing a new certificate fixes it, and visitors don't need to do anything once the new one is live.

Q: Is renewing the same as buying a new certificate?

For most paid certificates, a renewal is a new certificate issued for the same domain, usually with a fresh validation and a new or reused CSR. Some vendors discount or bundle renewals, and others treat them as a normal purchase. Check your provider's renewal policy rather than assuming a discount applies.

Q: Why did my Let's Encrypt auto-renewal stop working?

Common causes are a removed or disabled timer or cron job, a web server that no longer answers the HTTP validation request on port 80, a DNS change, or a certificate created with the manual option without an authentication hook. Wildcard certificates need a DNS plugin to renew automatically. Run `sudo certbot renew --dry-run` and read the error it prints.

By Umair Ali Sadaqat · Updated November 6, 2026 · Editorial policy

How to renew an SSL certificate: set up Let's Encrypt auto-renewal, renew a paid cert step by step, and plan for shorter certificate validity periods.

Short answer: If your certificate came from Let's Encrypt, run sudo certbot renew (or let the scheduled task your Certbot install already created do it). If you bought it from a certificate authority or reseller, renew from that vendor's dashboard, validate the domain again, and install the new certificate files on your server or host. Then check the new expiry date in a browser. Maximum certificate lifetimes are also shrinking, so the sooner you automate, the less often you will have to do this by hand.

First: find out when and where your certificate expires

Before renewing anything, confirm what you actually have.

Open your site in Chrome, click the padlock or site-info icon, then open the certificate details and note the "Valid to" date and the issuer.
Or check from a terminal: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer
If the issuer is Let's Encrypt, follow the auto-renew section below. If it is another authority, you probably have a paid certificate and need the paid-renewal steps.
If your site runs on a managed host or website builder, the platform usually handles renewal itself. Look for an SSL or domain security setting before touching files.

Not sure which type you have? The SSL certificate types guide explains domain, organization and extended validation, and the what is an SSL certificate glossary entry covers the basics.

Which renewal path fits you

Your situation	What to do	Effort
Let's Encrypt via Certbot on your own server	Confirm the scheduled `certbot renew` task runs, then test with `--dry-run`	Low, mostly one-time
Certificate from a paid certificate authority or reseller	Renew in the vendor dashboard, validate, install the new files	Manual, repeat each term
Managed host or site builder with built-in SSL	Check the SSL setting; renewal is normally automatic	Minimal
Certificate behind a CDN or load balancer	Renew at the CDN or load balancer, not on the origin	Depends on setup

Renew a Let's Encrypt certificate (auto-renew)

Let's Encrypt certificates are designed to be renewed by software. Certbot's own documentation says most installations come with automatic renewal preconfigured, using a scheduled task that runs certbot renew periodically.

Step by step

Check that the scheduled task exists. On systemd machines, run systemctl list-timers and look for a Certbot timer. On others, check the crontab. Certbot's docs describe both places.
Run a dry run. sudo certbot renew --dry-run tests renewal against Let's Encrypt's staging server. It obtains test certificates but does not save them to disk, so it is safe on a live site.
Fix whatever it reports. Typical failures are a firewall blocking port 80, a web server config that no longer serves the validation path, or DNS pointing somewhere else.
Renew now if you need to. sudo certbot renew only touches certificates that are near expiry, so running it repeatedly is harmless.
Reload the web server after renewal if your setup does not do it automatically. Certbot supports deploy hooks that run only when a certificate was actually renewed.
Verify the new expiry date with the browser or openssl command above.

Cases where auto-renew will not work on its own

Certificates created with Certbot's --manual option do not renew automatically unless you pair them with an authentication hook script.
Wildcard certificates require DNS validation, so you need a DNS plugin for your DNS provider if you want them to renew unattended.
Servers that were migrated, rebuilt or cloned often lose the timer or cron entry even though the certificate files came along.

Renew on a schedule that survives shorter lifetimes

Let's Encrypt has announced it will move its default "classic" profile to 64-day certificates on February 10, 2027, then to 45-day certificates on February 16, 2028. Its guidance is that clients which don't use ACME Renewal Information (ARI) should not renew on a hardcoded schedule, and that renewing at a fixed 60-day interval will stop being enough. Certbot's renew command decides based on how much lifetime remains, which is the safer pattern. Keep Certbot updated and avoid wrapping it in your own fixed-interval script. Details are on Let's Encrypt's lifetimes announcement.

Renew a paid SSL certificate

Paid certificates do not renew themselves unless your vendor or host has set up auto-renewal. The names of buttons and menus differ between vendors, so treat this as the general order of operations and check your provider's docs for exact screens.

Start the renewal in your vendor account. Look for the certificate near its expiry date and choose renew, reissue or order again.
Generate a CSR. Many servers and control panels can create a certificate signing request. Some vendors let you reuse the old CSR, but generating a new key pair is generally a better habit.
Complete domain validation. You will usually be asked to prove control through an email to an approved address, a DNS record, or a file on your site. Organization and extended validation certificates may also require paperwork checks, so start those earlier.
Download the issued files. You typically receive the certificate plus an intermediate (chain) bundle.
Install them on your server, host or CDN, then restart or reload the web server.
Test. Load the site in a fresh browser window, check the expiry date, and make sure no "incomplete chain" or mixed-content warnings appear.
Update reminders and cancel the old certificate's auto-renew if you moved providers.

If you are comparing vendors or wondering what a renewal should cost, see the SSL certificate cost guide. Domain registration also renews separately, which is covered in the domain renewal cost guide.

Certificate lifetimes are getting shorter (verified November 2026)

The CA/Browser Forum approved ballot SC-081v3 in April 2025. It steps down the maximum lifetime of publicly trusted TLS certificates:

Issued on or after	Maximum validity
Before March 15, 2026	398 days
March 15, 2026	200 days
March 15, 2027	100 days
March 15, 2029	47 days

The practical effect is that anything you renew by hand now needs touching roughly twice a year, then roughly four times a year from March 2027, and about eight times a year by 2029. Domain validation reuse windows shrink too, so you cannot rely on an old validation to skip a step. The limits apply to publicly trusted certificates, so private or internal CAs follow their own rules.

If you are still renewing manually, the realistic options are to move to a CA or host that supports automated issuance (ACME), or to put a managed layer such as your host or a CDN in front of the site.

SSL renewal checklist

Copy this into your team's tracker:

`` [ ] List every certificate: domain, issuer, expiry date, where it is installed [ ] Note who owns each renewal (name, not a team alias) [ ] Set reminders at 30 and 14 days before expiry [ ] Let's Encrypt: confirm the Certbot timer or cron job exists [ ] Let's Encrypt: run certbot renew --dry-run and resolve errors [ ] Wildcards: confirm a DNS plugin or hook is configured [ ] Paid certs: confirm the validation contact email or DNS access still works [ ] Generate a new CSR and key if the vendor requires or recommends it [ ] Install the certificate AND the intermediate chain [ ] Reload the web server, CDN or load balancer [ ] Test the site in a fresh browser and check the new expiry date [ ] Test subdomains, www and non-www, and any API endpoints [ ] Remove expired certificates and retire old reminders [ ] Plan for 200 days now, 100 days from March 15, 2027 ``

Common renewal mistakes

Renewing the wrong layer. If a CDN or load balancer terminates TLS, renewing the origin certificate will not change what visitors see.
Forgetting the chain. Installing only the leaf certificate can work in one browser and fail in another or in an API client.
Not reloading the server. The new files can sit on disk while the old certificate is still being served.
Validation email going to a former employee. Make sure the contact address is monitored.
Trusting a single reminder. Calendar alerts get dismissed. Automation plus an external expiry monitor is sturdier.

If you are still deciding where to host

Hosting that includes SSL renewal removes this whole chore. We.Inc's free plan lets you publish up to three sites from ready-made templates, such as Nora Kessler Studio or Greenfield Renewables; the AI builder that drafts a site from a prompt starts on the Starter plan at $20 a month. You can sign up here.

FAQ

How do I renew a Let's Encrypt certificate?

Run sudo certbot renew. It only renews certificates close to expiry, so it is safe to schedule. Most Certbot installs already include a scheduled task, and sudo certbot renew --dry-run tests it without saving certificates.

How long is an SSL certificate valid in 2026?

The cap was 398 days until March 15, 2026, and is 200 days now. It becomes 100 days on March 15, 2027 and 47 days on March 15, 2029. Some authorities issue slightly under the cap.

What happens if my SSL certificate expires?

Browsers show a full-page security warning, and strict API clients can fail. Installing a renewed certificate fixes it for visitors without any action on their side.

Is renewing the same as buying a new certificate?

Usually a renewal is a newly issued certificate for the same domain, with fresh validation. Pricing and discounts vary by vendor, so check yours.

Why did my Let's Encrypt auto-renewal stop working?

Look for a missing timer or cron entry, blocked port 80, DNS changes, manual-mode certificates without a hook, or a wildcard without a DNS plugin. certbot renew --dry-run will show the specific error.

Related guides and tools

DNS lookup

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.