Renewals

Renewing keeps your protection in place when an SSL Certificate license is approaching the end of its term. What you do depends on the product you hold, and this page covers both paths.

A traditional SSL Certificate license is renewed by purchasing a new license. A Certificate as a Service (CaaS) license is extended instead, so the existing license continues without a new purchase. Renewal is separate from reissue, which provides a replacement SSL Certificate within a license you already hold, at no additional cost.

Renew Your SSL Certificate Reissue Your SSL Certificate

If your SSL Certificate has expired but your license period is still active, you do not need to renew. You reissue your SSL Certificate through the tracking system to obtain a replacement with updated validity. Learn About Maintaining Your Protection 🔗

Renewal and Reissue

Renewal and reissue are different actions, and knowing which one you need avoids an unnecessary purchase.

Renewal is a purchase you make when a license period has expired or is approaching expiry, extending your coverage for a new term of your choice. For a Certificate as a Service (CaaS) license, the equivalent step is an extension of the existing license.

A reissue provides a replacement SSL Certificate within a license you already hold, at no additional cost, with the maximum allowable validity up to your remaining license period. Under a Certificate as a Service (CaaS) license, reissue happens automatically through your Automatic Certificate Management Environment (ACME) client. Explore Our Tracking System 🔗

Renewing a Traditional SSL Certificate

A traditional SSL Certificate license is renewed by purchasing a new license, which follows the same procedure as ordering a new SSL Certificate. You then replace your existing SSL Certificate, Private Key, and Intermediate Certificates on your server. Learn About Your Traditional License History 🔗

Renewing early lets you test and install the new SSL Certificate alongside the existing one, so you can verify the installation before the current SSL Certificate expires.

Important : Do not leave your renewal until the last day. Order queuing or processing delays may prevent timely issuance, so renew and replace your SSL Certificate at least 14 days before your existing license expires.

Planning ahead gives you time to test the new SSL Certificate and resolve any installation issues before the changeover.

Extending a Certificate as a Service (CaaS) License

A Certificate as a Service (CaaS) license is not renewed by buying a new license. You extend the existing license instead, which keeps it active and lets your Automatic Certificate Management Environment (ACME) client carry on issuing without interruption.

To extend, choose the extension option on the product ordering page rather than the new license option, and provide your ACME Account ID. The system checks that the Account ID is valid for the product you have chosen and lets you extend by one to three years.

If a license is set up for automatic extensions, it is extended approximately 14 to 21 days before it expires, and an e-mail notification follows. There is no Certificate Signing Request (CSR) to generate and no manual installation, because issuance and installation are handled automatically. Learn About Certificate as a Service (CaaS) 🔗

License Validity Periods

SSL Certificate licenses can be purchased for periods of up to five years. Each issued SSL Certificate carries a shorter validity set by industry requirements, currently a maximum of 200 days, so a reissue is needed periodically during a multi-year license.

During a traditional multi-year license you reissue your SSL Certificate yourself before each expiry, at no additional cost. Under a Certificate as a Service (CaaS) license, your Automatic Certificate Management Environment (ACME) client performs each reissue automatically. Learn About SSL Certificate Validity Periods 🔗

Important : Partners and customers are responsible for monitoring the expiry dates of installed SSL Certificates. The ordering system displays all orders on an account with the purchased license validity dates, however each SSL Certificate has its own validity dates dependent on when it was issued within the license period.

The tracking system can be accessed on an order-by-order basis and displays both the license validity and the validity details of the last SSL Certificate issued.

Trustico® also offers plans that remove this manual tracking burden entirely, described next.

Automatic Protection Plans

An automatic protection plan renews a traditional SSL Certificate license for you, purchasing a new license each month or year so you do not have to place the order yourself. You remain responsible for reissuing the SSL Certificate as it approaches its maximum validity, unless you are using Certificate as a Service (CaaS).

For fully automated management, including automatic reissue, Certificate as a Service (CaaS) handles the entire SSL Certificate lifecycle without manual intervention. Compare Traditional SSL Certificates and Certificate as a Service (CaaS) 🔗

Certificate Signing Request

A Certificate Signing Request (CSR) applies to a traditional SSL Certificate order. A Certificate as a Service (CaaS) license does not need one, because your Automatic Certificate Management Environment (ACME) client handles it.

For a traditional order, the Certificate Signing Request (CSR) is generated from your hosting control panel, web server software, or server operating system. Trustico® provides resources to help you create one for various platforms.

Tip : Generate a new Certificate Signing Request (CSR) and Private Key when you renew. Fresh cryptographic keys reduce the risk associated with a Private Key compromised over time.

Once you have generated a new Certificate Signing Request (CSR), you can proceed to the renewal options.

Certificate Signing Request (CSR)

If you prefer not to generate your own Certificate Signing Request (CSR), the Trustico® AutoCSR service can create one during ordering, though it is best suited to non-production environments. For production systems, generate it on your own server so the Private Key never leaves your control. Learn About Certificate Signing Requests (CSR) 🔗

Installing Your Renewed SSL Certificate

Installation applies to a traditional renewal. After your new SSL Certificate is issued, you install it on your server along with the corresponding Intermediate Certificates, following the guide for your platform. A Certificate as a Service (CaaS) license installs automatically.

Installation Instructions

If you would prefer assistance, the Trustico® support team can help you complete your order and install your renewed SSL Certificate. View Our Support Resources 🔗

Microsoft Windows Server Warning

This applies when renewing a traditional SSL Certificate on Microsoft Internet Information Services (IIS). There is a known issue with the built-in renewal option that you should be aware of before proceeding.

Warning : Do not use the "Renew SSL Certificate" option within Internet Information Services (IIS). This built-in function has known limitations that may cause the renewal to fail. Instead, generate a new Certificate Signing Request (CSR) and install your renewed SSL Certificate as a new installation.

Treating the renewal as a fresh installation avoids the built-in function and gives a reliable, predictable result.

Most Popular Questions

Frequently asked questions covering how to renew a traditional SSL Certificate and extend a Certificate as a Service (CaaS) license, renewal versus reissue, when to renew, license validity periods, the Certificate Signing Request (CSR), and the Windows Internet Information Services (IIS) renewal issue.

Difference Between Renewing and Reissuing an SSL Certificate

Renewal is a purchase you make when a license period is expiring, extending your coverage for a new term, and for a Certificate as a Service (CaaS) license the equivalent step is an extension. A reissue provides a replacement SSL Certificate within a license you already hold, at no additional cost. Under Certificate as a Service (CaaS), reissue happens automatically.

Renewing a Traditional SSL Certificate

A traditional SSL Certificate license is renewed by purchasing a new license, which follows the same procedure as a new order. You then replace the SSL Certificate, Private Key, and Intermediate Certificates on your server. Renewing early lets you test the new SSL Certificate before the current one expires.

Extending a Certificate as a Service (CaaS) License

A Certificate as a Service (CaaS) license is extended rather than replaced with a new license. You choose the extension option on the product ordering page and provide your ACME Account ID, which the system validates before allowing an extension of one to three years. If automatic extensions are enabled, the license is extended approximately 14 to 21 days before expiry and an e-mail notification follows.

When to Renew Your SSL Certificate

Trustico® recommends renewing and replacing your SSL Certificate at least 14 days before your existing license expires. Do not leave it until the last day, as order queuing or processing delays may prevent timely issuance.

Maximum SSL Certificate License Period

SSL Certificate licenses can be purchased for periods of up to five years. Each issued SSL Certificate has a shorter maximum validity set by industry requirements, currently 200 days, so a reissue is needed periodically during a multi-year license.

Generating a New Certificate Signing Request (CSR) When Renewing

A new Certificate Signing Request (CSR) is recommended when renewing a traditional SSL Certificate, because fresh keys reduce the risk from a Private Key compromised over time. If you prefer not to generate your own, the Trustico® AutoCSR service can create one during ordering, though it suits non-production environments. A Certificate as a Service (CaaS) license does not need a Certificate Signing Request (CSR).

Avoiding the Renew SSL Certificate Option in Internet Information Services (IIS)

The built-in renewal function within Internet Information Services (IIS) has known limitations that may cause the renewal to fail. Instead, generate a new Certificate Signing Request (CSR) and install your renewed SSL Certificate as a new installation.

1 5