How Auto-Renewal Works for SSL Certificates
Last updated
Table of Contents
- What auto-renewal does
- Which certificates support auto-renewal
- When auto-renewal runs
- Enabling and disabling auto-renewal
- What happens after auto-renewal succeeds
- What happens when auto-renewal fails
- Why auto-renewal matters more with shorter lifetimes
- Have more questions?
SSL certificates have a fixed validity period and cannot be extended once issued. When a certificate is about to expire, a new one must be ordered, validated, and installed to maintain uninterrupted HTTPS coverage. Auto-renewal automates the ordering and validation steps, so you do not have to remember to renew manually.
What auto-renewal does
Auto-renewal is not an extension of the existing certificate. Like all SSL certificate renewals, it is a new certificate request. When auto-renewal runs, DNSimple:
- Creates a new certificate order using the same settings as the current certificate (host names and key type).
- Submits the domain validation challenge automatically (DNS-based for Let’s Encrypt).
- Retrieves the newly issued certificate from the Certificate Authority.
- Sends an email and webhook notification to let you know the new certificate is ready.
After auto-renewal completes, the new certificate is available to download from your DNSimple account. You will still need to install the new certificate on your server. Auto-renewal does not deploy the certificate for you.
Tip
To fully automate the process, including installation, use the DNSimple Certificates API to fetch and deploy the certificate programmatically.
Which certificates support auto-renewal
| Certificate type | Auto-renewal supported | Why |
|---|---|---|
| Let’s Encrypt (single-name and wildcard) | Yes | Let’s Encrypt uses DNS-based validation, which DNSimple can perform automatically because the domain resolves with our name servers. |
| Sectigo (single-name and wildcard) | No | Sectigo uses email-based validation, which requires a human to click an approval link. This step cannot be automated. |
For Sectigo certificates, you will need to renew manually each time. DNSimple sends expiration notifications to remind you when renewal is due.
When auto-renewal runs
Let’s Encrypt certificates are valid for 90 days. DNSimple starts auto-renewal 30 days before the expiration date, as recommended by Let’s Encrypt. If the renewal cannot complete, that leaves time to fix the cause and renew the certificate yourself before it expires. DNSimple does not retry a failed auto-renewal on its own.
Enabling and disabling auto-renewal
You can enable or disable auto-renewal from the SSL certificate page in your DNSimple account. The toggle is available both when ordering a new Let’s Encrypt certificate and on the certificate detail page after issuance. For step-by-step instructions, see How to Set Up Auto-Renewal for SSL Certificates.
Auto-renewal is available at no additional cost. The certificate must not be expired to enable auto-renewal. If a certificate has already expired, you will need to order a new one.
What happens after auto-renewal succeeds
When the new certificate is successfully issued:
- You receive an email notification from DNSimple.
- A webhook event is triggered (if you have webhooks configured).
- The new certificate and its private key are available to download from your certificate page.
- The previous certificate remains valid until its original expiration date.
Warning
The new certificate must be installed on your server to replace the old one. If you don’t install it, your site will continue using the old certificate until it expires, at which point browsers will show a security warning.
What happens when auto-renewal fails
Auto-renewal can fail for several reasons, and DNSimple does not retry it automatically. What happens depends on when it fails:
-
Before the order is placed. DNSimple checks that the account has an active subscription with Let’s Encrypt on its plan, and that the domain still resolves with DNSimple. If a check fails, DNSimple turns off auto-renewal for the certificate, sends you an email explaining why, and triggers a
certificate.auto_renewal_failedwebhook event. - During issuance. If Let’s Encrypt refuses the renewal, for example because of CAA records or rate limits, the renewal order fails and DNSimple emails you. Auto-renewal does not try that certificate again.
In both cases, fix the cause and renew the certificate manually. If you want future renewals to be automatic, turn auto-renewal back on after the renewal is issued.
Common causes of auto-renewal failure:
- Domain no longer resolving with DNSimple. Let’s Encrypt certificates require the domain to be delegated to and resolving with DNSimple’s name servers. If the domain’s delegation has changed (e.g., moved to another DNS provider), the DNS challenge will fail.
- DNSSEC misconfiguration. If DNSSEC is enabled for the domain but is misconfigured (e.g., stale DS records at the registrar), the DNS challenge may fail because the CA cannot securely resolve the validation record. See Troubleshoot DNSSEC configurations.
- Let’s Encrypt rate limits. Let’s Encrypt enforces rate limits on certificate issuance. If you have a large number of certificates for the same domain, you may temporarily hit these limits.
- CAA records blocking issuance. If CAA records are configured for the domain and Let’s Encrypt is not listed as an authorized CA, the issuance will be denied.
Once you fix the underlying cause (delegation, DNSSEC, CAA records), renew the certificate manually. If the certificate has already expired, order a new Let’s Encrypt certificate.
Why auto-renewal matters more with shorter lifetimes
The CA/Browser Forum is phasing in shorter maximum certificate lifetimes, from 200 days in March 2026 down to 47 days by March 2029. As these lifetimes shrink, the full renewal cycle (order, validate, issue, install) repeats more frequently.
Let’s Encrypt certificates (90-day validity) already require frequent renewal. Auto-renewal handles this automatically. When the maximum drops to 47 days in 2029, all certificate types will need very frequent renewal. Auto-renewal, combined with automated installation through the DNSimple API, will be essential for maintaining uninterrupted HTTPS coverage.
Sectigo certificates do not currently support auto-renewal due to their email-based validation requirement. As validity periods shrink, the manual effort required to maintain Sectigo certificates will increase. If automation is a priority, Let’s Encrypt certificates may be a better fit for your workflow.
Have more questions?
If you have any questions about auto-renewal or need assistance with your SSL certificates, just contact support, and we’ll be happy to help. You can also read more about SSL certificates at DNSimple.