How to Automate Certificate Renewal for the 47-Day Era

When certificates lasted a year, renewal could be a calendar reminder. As maximum lifetimes fall to 47 days, every renewal that depends on a person will eventually be missed. The only reliable answer is to automate the whole process, not just the request.

Renewal Is More Than Issuance

Getting a new certificate from a CA is the easy part. A complete renewal has six steps, and an outage can come from any of them:

1. Request: generate a new key and certificate signing request.
2. Validate: prove control of every domain name on the certificate.
3. Issue: the CA signs and returns the certificate.
4. Deploy: install it on every endpoint that serves it.
5. Reload: make the service actually start using the new certificate.
6. Verify: confirm the endpoint now presents the new certificate.

Most automation covers the first three. Most renewal outages happen in the last three: the certificate was renewed, but a load balancer, an appliance, or a second server still holds the old one.

When to Renew

Let's Encrypt recommends renewing when about a third of a certificate's lifetime remains. For a 47-day certificate, that means renewing around day 30, which leaves roughly two weeks to notice and fix a failure.

Rather than hard-coding a schedule, use ACME Renewal Information (ARI), published as RFC 9773 in June 2025. With ARI, the CA tells your client when to renew. That spreads load and, more importantly, lets a CA ask for early renewal when certificates must be replaced ahead of schedule, such as after a mis-issuance.

Shorter Lifetimes Are Coming Faster Than 2029

The CA/Browser Forum's schedule caps public certificates at 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. Let's Encrypt, the largest public CA, is moving on its own timeline:

• May 13, 2026: 45-day certificates available through the opt-in tlsserver profile.
• February 10, 2027: the default profile moves to 64-day certificates, with a 10-day authorization reuse period.
• February 16, 2028: the default moves to 45-day certificates, with authorizations reusable for only 7 hours.

Seven-hour authorization reuse means domain validation effectively happens on every renewal, which makes the next step essential.

Automate Domain Validation

ACME offers several ways to prove domain control. HTTP-01 is simple but needs port 80 reachable from the internet and can't issue wildcard certificates. DNS-01 works for internal hosts and wildcards, but needs your automation to create DNS records.

Giving every server write access to your main DNS zone is a risk of its own. A common pattern is CNAME delegation: point each _acme-challenge record at a separate zone used only for validation, and give automation access to that zone alone.

Automate Deployment to Every Endpoint

Each kind of endpoint needs its own delivery path:

• Web servers and proxies with ACME clients such as certbot, acme.sh, Caddy, or Traefik.
• Kubernetes through cert-manager, which renews certificates and updates Secrets.
• Windows and Linux servers without an ACME client, through an agent that installs the certificate and reloads the service.
• Network appliances such as load balancers and session border controllers, through their management APIs.

Appliances are where manual renewals tend to survive longest, because they often can't run an ACME client. They are also where an expired certificate takes down the most traffic.

Verify, Then Monitor

After each renewal, connect to the endpoint and check the certificate it actually serves. A renewal that succeeded at the CA but never reached the endpoint is the most common silent failure.

Independently of renewal, keep expiry monitoring with alerts that reach the owner of each service, set to fire before the renewal window closes. Monitoring is your safety net for the cases automation didn't anticipate. For a quick spot check of a single site, use our free SSL/TLS checker.

Keep Control While You Automate

Automation multiplies whatever it is pointed at, including mistakes. Before turning on high-volume renewal, decide which domains may receive certificates, from which CAs, and which requests need a person to approve them. Routine renewals of approved certificates can flow automatically; new names and wildcards are worth a second look. See why human approval workflows matter.

A Renewal Automation Checklist

1. Inventory every certificate and where it is deployed. See how to find every certificate you have.
2. Renew at about one-third of remaining lifetime, and support ARI where your CA offers it.
3. Use DNS-01 with CNAME delegation, so validation needs no manual steps.
4. Give every endpoint type an automated delivery path, including appliances.
5. Verify the served certificate after each renewal.
6. Alert the service owner before the renewal window closes.
7. Put policy and approvals in front of issuance.