SSL Certificate Renewal: How to Renew and Automate It

An expired SSL certificate can make a trusted website show a browser warning. SSL certificate renewal replaces the expiring certificate, and the right process can keep your site online while you do it. Here’s how to check what you have, renew it safely, and reduce the risk of missing the next expiry.

Table of Contents

• Step 1: Check the expiry date, certificate type and risks
• Step 2: Choose the right renewal route for your certificate
• Step 3: Renew, install and verify the certificate safely
• Step 4: Automate renewals and set up expiry alerts
• Frequently asked questions
• Conclusion

Step 1: Check the expiry date, certificate type and risks

Start by finding out which certificate protects each public website address. Check the root domain, its www version and any subdomains your business uses. If your site has a booking area or client portal on a separate subdomain, check that too.

Open your hosting panel or certificate provider’s account and note the expiry date, certificate type and issuing provider. A browser can also show certificate details: open your site over HTTPS, select the security icon beside the address bar, then view the certificate information. Record the date somewhere your team will see it.

An SSL certificate helps a browser confirm a site’s identity and set up an encrypted connection. If it expires, visitors may see a warning before they reach your pages. Some will leave rather than continue, which can interrupt enquiries and damage trust.

Check whether the certificate covers one domain, several named domains, or a wildcard. A wildcard certificate can cover subdomains under a domain, while a multi-domain certificate can cover more than one listed name. Match the certificate’s names to the addresses your visitors actually use.

Keep an inventory with the domain, expiry date, certificate owner and renewal route. If you’d rather have hosting, SSL, security updates, monitoring and backups handled as part of one service, see HockWorks’ website maintenance in Singapore. It costs S$600 a year, with the renewal still needing to be initiated each year.

Key Takeaway: Check every domain and subdomain, then record who owns each renewal.

Step 2: Choose the right renewal route for your certificate

The renewal route depends on where the certificate is managed. If your host provides SSL through a control panel, start there. A panel may show an automatic renewal option or a button to run its SSL tool. Check whether it renews and installs the certificate for you, or only issues a replacement for you to install.

For a paid certificate, sign in to the account that owns it and follow its renewal or reissue process. The certificate itself can’t simply have its expiry date extended. The expiring certificate must be replaced with a new one, then installed on the server.

Some certificate types may need extra checks. Confirm the requirements in your own provider account before you start.

Let’s Encrypt certificates are free and typically valid for 90 days. They suit sites where someone can manage the server or hosting setup. Certbot can request and renew them, but a working scheduled task is needed for repeat renewals. A control panel may also provide a managed SSL feature, so check what your host includes before adding another process.

HockWorks’ Managed Website service includes hosting and SSL as part of its annual service. Its price is a clear S$600 per year, but it doesn’t remove the need to start the renewal each year. That can suit an owner who wants one service to keep an eye on website care, provided the renewal task has a named owner and calendar reminder.

Before choosing, ask who will renew the certificate, who will install it, and how you’ll know the change worked. If no one on your team has server access or time to check the process, a managed service may be a better fit than a command-line setup.

Step 3: Renew, install and verify the certificate safely

Make the change before the old certificate expires. If you manage a server with Certbot, first check that it is installed and that its renewal settings match the site. Then test the renewal path with a dry run:

sudo certbot renew --dry-run

A successful dry run tests the renewal setup without replacing the live certificate. If it fails, read the error before you try a live renewal. A common cause is a domain check that can’t reach the site or DNS records that point to the wrong server. Fix the cause, then repeat the test.

When the test passes, run the renewal command. For a particular certificate, Certbot can target its renewal configuration; check the options for your installed version before changing a production service. A hook can reload the web server after a new certificate is issued.

If you renew through a provider portal, complete its domain validation step first. Then install the new certificate and any required chain files in the hosting panel. Keep the private key private. If you generated a new key or certificate signing request, use the matching key when installing the certificate.

For a safer change, use a staging site or test server when your setup allows it. That gives you a place to check the certificate and reload process before making the same change on the live site. If you can’t use staging, choose a quiet time and make sure you can restore the previous configuration.

After installation, open the site in a browser and check the certificate’s new expiry date. Test the main domain and each covered subdomain. You can also inspect the connection from a terminal with openssl s_client -connect example.com:443 -servername example.com, replacing the sample domain with your own. Check the certificate presented by the server, not only the file saved in your hosting account.

Step 4: Automate renewals and set up expiry alerts

Automation helps prevent a missed date, but it only works when the renewal task is active and someone checks that it succeeds. Many Certbot installations use a scheduled task, such as a cron job, to check for certificates that need renewal. Confirm that the task exists and is running rather than assuming setup happened during installation.

Run a dry test after setting up the schedule. If your web server needs a reload after renewal, add a deploy hook or configure the renewal tool to reload it. A certificate can renew successfully on disk while the server continues to present the old one, so the reload and the browser check both matter.

Set a separate expiry alert as a safety net. Send it to an inbox someone checks, and include the domain name and expiry date in the alert. Where possible, send a second alert to another responsible person. This helps if the main owner is away or an email rule hides the first message.

Keep payment details current if your certificate or hosting plan renews through a paid account. A declined payment can block a renewal even when automatic billing is enabled. Check the account before the renewal window and confirm that the domain and hosting plan remain active.

Shorter certificate lifetimes make manual renewal harder to manage over time. Don’t build a process around one annual reminder alone. Make the system test its renewal path on a schedule, alert on failure, and give a named person responsibility for fixing errors.

If you run a service business and would rather not own hosting checks yourself, HockWorks’ Managed Website service covers hosting, SSL, security updates, monitoring and backups for S$600 a year. It still requires a renewal to be initiated annually, so agree who will handle that step and when.

Pro Tip: Put the renewal owner and the alert recipient in the same record as the certificate expiry date. A reminder without an owner is easy to miss.

Key Takeaway: Treat automation as a process to test, not a setting to switch on and forget.

Frequently asked questions

What happens if my SSL certificate expires?

Visitors may see a browser warning that the connection is not private when they open your site. Some browsers may block access or ask visitors to accept a risk warning. That can stop people from reaching a contact form or service page. Renew the certificate, install it on the right server, then check the live site to confirm the new certificate is being served.

Can I renew an SSL certificate without downtime?

In many setups, renewal can be completed without taking the website offline. The key is to issue and install the new certificate correctly, then reload the web server if your setup needs it. Test the renewal first and avoid changing live settings without a way to restore them. A poorly timed or incorrect install can still cause connection warnings.

How often do I need to renew a Let’s Encrypt certificate?

Let’s Encrypt certificates are typically valid for 90 days, so set up automatic renewal rather than relying on a yearly reminder. Certbot can check for certificates that need renewal through a scheduled task. Test that task with a dry run, then check that the web server serves the renewed certificate after the process completes.

Does HockWorks automatically renew SSL certificates?

HockWorks’ Managed Website service includes SSL, hosting, security updates, monitoring and backups for S$600 a year. The SSL renewal itself needs to be initiated annually, so it isn’t a hands-off automatic renewal. If you use the service, agree on who owns that task and set a reminder before the certificate expires.

How can I check that my renewed certificate is working?

Open the website in a browser and view the certificate details beside the address bar. Confirm that the displayed expiry date has changed and that the certificate covers the domain you opened. Repeat the check for key subdomains. If the browser still shows the old expiry date or a warning, check the installation and server reload.

Conclusion

Set a renewal owner, test the process before expiry, and keep an alert as a backup. If you’d like HockWorks to look after hosting and website care, book a free 15-minute Clarity Call with HockWorks to discuss whether Managed Website is a fit.