SSL Certificate Renewal: How to Renew Every 90 Days?

Free SSL certificates (Let's Encrypt) are valid for 90 days. This short period is an advantage in terms of security; however, if you forget to renew, your site will suddenly start showing a "not secure" warning. In this guide, we explain the ways to renew your certificate on time and without trouble — manual renewal, reminder emails, and automatic renewal.

Why 90 days?

The short validity period has two major benefits: even if a key is compromised, the window of damage is shorter, and the renewal habit encourages automation. That's why 90 days has become the standard of modern web security.

Track the expiry

You can always find out your certificate's end date from the terminal:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -enddate

If you have a member account, the My Panel screen shows the remaining days for all your certificates along with "expiring soon" badges; at a glance, you can tell which one needs renewing.

Method 1 — Reminder emails

If you leave the "remind me before expiry" option enabled when generating the certificate in the wizard, you'll be alerted by email 30, 7, and 1 day before expiry. This is the easiest way not to forget to renew. The address the reminders go to is the email you entered in the application; so use a valid address you have access to.

Method 2 — Manual renewal (3 steps)

Manual renewal is exactly the same as getting the first certificate:

1. Open our free SSL wizard and enter the same domain.
2. Complete the same verification method (DNS TXT or HTTP file). If your DNS record is still in place, verification passes instantly.
3. Download the new ZIP package (certificate.crt, private.key, ca_bundle.crt, fullchain.pem, certificate.pfx) and overwrite the old files on the server.

Finally, reload your service; there's no downtime:

# Nginx
sudo nginx -t && sudo systemctl reload nginx

# Apache
sudo apache2ctl configtest && sudo systemctl reload apache2

If you use IIS, import the new certificate.pfx file and select the new certificate in the binding. In cPanel, update the three boxes with the new contents in the SSL/TLS manager.

Method 3 — Automatic renewal

If you have SSH access to your server, you can automate the renewal with a scheduled task (cron) and completely eliminate the "forgot to renew" problem. The logic is this: the task runs periodically, and if the certificate is close to expiry, it renews it and reloads the server gracefully.

# Example: a cron line that checks for renewal every day at 03:00
0 3 * * * /usr/local/bin/ssl-renew.sh >> /var/log/ssl-renew.log 2>&1

Automation is especially powerful together with DNS-01 verification; if your DNS provider's API supports it, the TXT record can also be updated automatically. If you use shared hosting and don't have SSH access, the most practical way is manual renewal every 90 days with reminder emails.

Post-renewal checklist

1. Verify that the new files overwrote the old ones.
2. Reload the service; there's no need to stop the server completely.
3. Confirm with openssl ... -enddate that the end date has moved to a future date.
4. Check the lock icon and the chain in the browser.

Frequently asked questions

• Should I use the same private key? It's not necessary; generating a new key on each renewal is more secure. The ZIP already brings a matching new private.key.
• If I renew early, does the remaining time go to waste? No. The new certificate is valid for 90 days from the moment it's installed; renewing early is safe.
• I missed the renewal — what happens? The site shows a "not secure" warning, but the content isn't deleted. The warning disappears as soon as you install the new certificate.

Summary

Renewing your 90-day certificate is the same three steps as the first time. Keep the reminder emails enabled, automate with cron if possible, and download the ZIP and overwrite the old files on each renewal. To renew right away, use our free SSL wizard.