How to Renew an SSL Certificate: A 2026 Guide

SSL renewal is one of those things that breaks the site when forgotten. The right way to renew depends on the issuer: Let’s Encrypt is fully automated with certbot, commercial CAs require a manual renewal flow, and self-signed certificates require the team to generate a new one. The wrong way to renew is to wait until the certificate expires and the site goes down.

Table of contents

• The two flows
• Let’s Encrypt
• Commercial CAs
• Self-signed
• The runbook
• The monitoring
• FAQ

The two flows

The two flows:

• Automated renewal. The certificate is renewed automatically before it expires. The team does nothing; the certificate is renewed and replaced without a human in the loop. The right answer for almost every workload.
• Manual renewal. The team has to renew the certificate manually. The team has to track the expiration, generate the new certificate, and install it. The right answer only when automated renewal is not possible (e.g., a commercial CA that does not support ACME).

Let’s Encrypt

Let’s Encrypt is the default for most workloads in 2026. The right way to renew:

• Use certbot (or the equivalent ACME client for the team’s web server).
• Run certbot renew --dry-run to verify the renewal works.
• Schedule the renewal to run twice a day (the default).
• Set up a post-renew hook to reload the web server.

The certbot default is to renew certificates that are within 30 days of expiring. The renewal is non-disruptive; the web server reloads the new certificate without dropping in-flight connections.

Commercial CAs

Commercial CAs (DigiCert, Sectigo, Entrust, etc.) require a manual renewal flow. The right way to renew:

• Set a calendar reminder 30 days before the certificate expires.
• Generate a new CSR (certificate signing request) on the server.
• Submit the CSR to the CA’s portal.
• Verify the domain ownership (usually via DNS or HTTP challenge).
• Download the new certificate and intermediate certificates.
• Install the certificate on the server.
• Reload the web server.

The trap: the team forgets the calendar reminder, the certificate expires, the site goes down. The fix is to set up monitoring that alerts 30 days, 14 days, and 7 days before expiration.

Self-signed

Self-signed certificates are the right answer for internal workloads (a service-to-service communication, a dev environment). The right way to renew:

• Use openssl to generate a new CSR and a new private key.
• Sign the certificate with the team’s internal CA.
• Distribute the new certificate to the services that need it.
• Reload the services.

The trap: the team forgets the expiration, the services fail to connect, the team does not know why. The fix is to set up monitoring that alerts 30 days, 14 days, and 7 days before expiration.

The runbook

The runbook for any renewal flow:

• The team has a list of every certificate, the issuer, the expiration, and the renewal flow.
• The team has a calendar reminder 30 days, 14 days, and 7 days before each expiration.
• The team has a documented renewal flow per certificate (the commands, the verifications, the rollback).
• The team tests the renewal flow at least once a quarter (especially for the Let’s Encrypt flow; the commercial CA flow is harder to test).

The monitoring

The monitoring for certificate expiration:

• A weekly job that lists every certificate, the issuer, the days to expiration, and the renewal status.
• An alert at 30 days, 14 days, and 7 days before expiration.
• An alert at 24 hours before expiration (the final warning).
• A page at 1 hour before expiration (the team is paged if the renewal has not happened).

FAQ

How do I renew an SSL certificate?

Depends on the issuer. Let’s Encrypt: certbot renews automatically. Commercial CAs: manual flow with CSR generation and CA submission. Self-signed: openssl generates a new certificate.

What happens if I forget to renew?

The site goes down. The browser shows a security warning, the API returns an error, and the user cannot connect. The fix is to set up monitoring that alerts 30 days, 14 days, and 7 days before expiration.

Can I automate Let’s Encrypt renewal?

Yes. Certbot runs twice a day by default, renews certificates that are within 30 days of expiring, and reloads the web server. The team has to do nothing.

How do I renew a commercial CA certificate?

Set a calendar reminder 30 days before expiration. Generate a new CSR. Submit the CSR to the CA. Verify domain ownership. Download the new certificate. Install on the server. Reload the web server.

What is the best monitoring for certificate expiration?

A weekly job that lists every certificate, the issuer, the days to expiration, and the renewal status. An alert at 30 days, 14 days, and 7 days before expiration. A page at 1 hour before expiration.

If you are sizing the SSL/TLS tier for a new project, the RunxBuild hosting calculator is the place to model the line items. The certificates, the issuers, the renewal - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual certificate status in one place.