SSL Certificate Renewal vs. Reissue: What's the Difference
People use "renew" loosely to describe anything that keeps a certificate valid, but two different things can happen behind the scenes. A renewal usually means buying or continuing a subscription so a domain stays covered by SSL over time. A reissue is what a certificate authority actually does to produce the new certificate itself — a new serial number, a new key if you choose one, and a new expiry date, delivered under an existing order or a new one.
That distinction matters more than it used to. Under CA/Browser Forum rules, the maximum lifetime of a publicly trusted SSL certificate is dropping in stages — 200 days from March 2026, 100 days from March 2027 and 47 days by March 2029 (see our breakdown of the shrinking SSL certificate validity timeline). A certificate you buy for one, two or three years is no longer a single, long-lived file: it's a subscription, and the certificate itself gets reissued — with a fresh validity period — one or more times within that term.
Whether an early renewal or reissue carries over any unused days from your current certificate or subscription depends on the specific product and certificate authority, so check the product details or your pricing page rather than assuming.
When to Start Renewing an SSL Certificate (Don't Wait for the Last Day)
The biggest renewal mistake is treating it as a same-day task. Domain validation can take anywhere from a few minutes — for automated DNS or HTTP checks — to longer if a manual step or organization vetting is involved, and installing and verifying a new certificate on production systems always takes longer than expected under time pressure.
As a rule of thumb, start the renewal process well before the certificate's end date — many teams begin around 30 days out, and some products or certificate authorities will let you renew even earlier. Because maximum validity periods are getting shorter — 200 days from 2026, 100 from 2027, 47 by 2029 — and certificates need touching far more often, it helps to build renewal into a recurring calendar step rather than a once-a-year memory.
If you manage several domains, don't wait until the closest expiry date to start planning: list every certificate, its expiry date and who's responsible for it, so renewals never depend on someone remembering by chance.
How to Renew an SSL Certificate: Step by Step
The exact screens vary by certificate authority or reseller platform, but renewing — or reissuing — an SSL certificate generally follows the same sequence:
- Generate a new CSR and, ideally, a new private key. Reusing an old key works technically, but a fresh CSR and key pair is the safer default, especially if you're not certain the old key has stayed private.
- Place a renewal order or request a reissue. Depending on where you are in your subscription term, this might be a brand-new order or a reissue against an existing one — check your reseller panel or provider to see which applies.
- Complete domain validation again. Even if nothing about your domain has changed, most renewals require you to re-prove control of it — a DNS CNAME/TXT record, an HTTP file or an email confirmation, depending on the method you choose.
- Install the new certificate and its full chain. Install the certificate together with the intermediate chain your server needs, not just the end-entity file; see our SSL certificate installation guide for the specific steps on Nginx, Apache and cPanel.
- Verify the new certificate is actually live. Check the expiry date, chain and common name in a browser or with a command-line tool before you consider the job done.
- Remove or retire the old certificate and key. Once the new certificate is confirmed working, take the old certificate out of rotation and, if it's no longer needed anywhere, treat its private key as retired.
What Happens When an SSL Certificate Expires
If a renewal is missed and the certificate's end date passes, browsers stop treating the connection as valid — visitors typically see a full-page warning rather than a small icon, and many won't click through it. The specific error depends on the browser and the exact problem, but an expired certificate commonly shows as NET::ERR_CERT_DATE_INVALID in Chromium-based browsers, or a similar "certificate expired" message elsewhere; see our guide to common SSL certificate errors for how to read and fix them.
An expired certificate doesn't just look bad — for many sites it blocks checkout flows, API calls and anything else that depends on a trusted HTTPS connection. The fix is the same as a normal renewal: generate a new CSR if needed, reissue or reorder the certificate, complete domain validation, and install it. There's no special "recovery" process beyond doing those steps as quickly as possible.
Keeping Track of Renewals Across Many SSL Certificates
Manually remembering expiry dates works fine until you have more than a handful of certificates — and with maximum validity periods shrinking toward 100 and eventually 47 days, even a single domain will need attention far more often than the old "once a year" habit.
SSLCipher sends e-mail notifications when an order is placed, while domain validation is pending, once a certificate is issued, and as expiry reminders 30, 14, 7 and 1 days before the end date, in the reseller's own language — the optional ones can be switched off in your profile. Inside the reseller panel, each certificate's status is visible step by step — order placed, domain validation, issued — and you can change the validation method, request a reissue or download the certificate, chain or PFX file directly from there, without private keys ever being sent by e-mail.
For a handful of domains, those reminders and the panel's status view are usually enough. For dozens or hundreds, they're a safety net around something that should really be automated.
Automating SSL Certificate Renewal
Once you're responsible for more certificates than you can comfortably track by eye, automation stops being optional. Two routes are common: the ACME protocol — the same automated issuance and validation protocol behind Let's Encrypt, also supported by some commercial certificate authorities — and a certificate authority or reseller's REST API, which lets your own scripts or configuration-management tools request, validate, reissue and download certificates on a schedule.
We cover the two approaches, the full lifecycle worth automating, and a practical rollout plan in detail in our guide to SSL certificate automation. As a starting point, automate CSR generation, reissuance and domain validation together, so a shorter validity period becomes a script running quietly on a schedule instead of a recurring task on someone's calendar.
Renew SSL Certificates Before They Expire
Renewing an SSL certificate is straightforward in isolation — new CSR, new or repeated order, domain validation, install, verify — but the shrinking maximum validity period means it now happens far more often than it used to. Building a simple habit around it, or automating it outright, is the difference between a routine reissue and an emergency browser warning.
SSLCipher's reseller panel shows every certificate's status, sends expiry reminders well ahead of the end date, and lets you reissue or reorder without waiting on manual steps. If you're comparing products or terms before your next renewal, our SSL certificates overview and public pricing page are good places to start.
Frequently asked questions
01When should I start renewing an SSL certificate?
Start well before the expiry date rather than on the last day — many teams begin around 30 days out, since domain validation and installing the new certificate both take time. As maximum certificate lifetimes shrink toward 100 and then 47 days, building renewal into a recurring calendar step matters more than ever.
02What's the difference between renewing and reissuing an SSL certificate?
Renewal usually refers to keeping a domain covered by SSL over time, often through a subscription. Reissue is what the certificate authority actually does to produce the new certificate — a new serial number and expiry date, and optionally a new key — which can happen more than once within a single multi-year subscription term.
03Do I need a new CSR and private key to renew an SSL certificate?
It's not always required, but generating a new CSR and private key is the safer default for a renewal, especially if you can't be fully certain the old key has remained private. Some providers and workflows make this the standard step for every renewal or reissue.
04If I renew early, do I lose the remaining days on my current certificate?
Whether unused days carry over depends on the specific product and certificate authority — providers handle this differently. Check your product terms or your provider's pricing page rather than assuming, especially for multi-year subscriptions that are fulfilled through periodic reissues.