Renew a Certificate
The CLM supports two renewal modes: manual, triggered by the user at any time, and automatic, where the CLM renews the certificate on its own before it expires.
Manual renewal
All CAs
- Go to Certificates in the sidebar menu
- Locate the certificate and click ⋮ Actions
- Select Renew certificate
The CLM starts the renewal using the CA and validation method configured in the certificate's Auto-Renewal tab.
If **Renew certificate** is disabled, the certificate has no CA associated with it. Go to the **Auto-Renewal** tab in the certificate details and link a CA.
DigiCert — Renewal
Renewal in DigiCert creates a new order, unlike other CAs which reuse the existing order.
- Go to Certificates, locate the DigiCert certificate, and click ⋮ Actions → Renew certificate
- A confirmation alert is displayed informing that:
- A new order will be created in DigiCert (new
order_id) - A new full domain validation (DCV) will be required
- The current certificate remains valid until it expires
- A new order will be created in DigiCert (new
- Click Confirm
- The Configure DigiCert Renewal modal is displayed. Fill in the fields:
| Field | Description |
|---|---|
| Common Name (CN) | Main domain of the certificate |
| SANs | Additional domains |
| Order Validity Unit | Years or Days |
| Order Validity | Order validity period (max. 3 years) |
| Certificate Validity | Certificate validity — optional, defaults to the same as the order (max. 3 years) |
- Click Confirm Renewal
The DigiCert account and DNS settings are automatically retrieved from the certificate's Auto-Renewal tab.
After confirming, a new order is created in DigiCert. Track the validation by clicking ⋮ Actions → Order Status — the domain validation flow is the same one described in the DigiCert issuance guide.
DigiCert — Reissue
Reissuing reissues the certificate within the same existing order, keeping the order_id. Use this when you need to regenerate the certificate without creating a new order.
- Go to Certificates, locate the DigiCert certificate, and click ⋮ Actions
- Select Reissue certificate
- A confirmation alert is displayed — click Confirm
- The reissue starts automatically using the same data as the current certificate
Track progress by clicking ⋮ Actions → Order Status. The domain validation flow is identical to renewal.
Configure automatic renewal
Automatic renewal is configured individually per certificate, in the Auto-Renewal tab within the certificate details.
- Go to Certificates in the sidebar menu
- Click View details on the desired certificate
- Go to the Auto-Renewal tab
- Enable the Enable automatic renewal toggle
- Configure the parameters:
| Field | Description |
|---|---|
| Renew before expiry | How many days before expiration the CLM should start the renewal. Default: 30 days |
| Retry interval | If the renewal fails, how many days to wait before trying again. Default: 7 days |
- Under Certificate Authority, confirm or click Change to select the CA that will be used for the renewal
- Under Domain Validation, confirm or click Change to select the validation method (e.g. Route 53 with automatic DNS-01)
- Click Actions to save
For production certificates, use 30 days of lead time with a 7-day retry. This guarantees up to 4 attempts before expiration in case something fails.
Track renewals via Monitor
To track the status of ongoing renewals or check the event history:
- Go to Monitor in the sidebar menu
- On the Certificate Lifecycle tab, you'll see the real-time event feed
Events can be filtered by type:
| Filter | What it shows |
|---|---|
| All | All lifecycle events |
| Renewals | Only certificate renewal events |
| Installations | Store installation events |
| Cleanup | Post-installation cleanup events |
Each event shows the domain, status (success, in_progress, pending, error), source, and time. Click View to see the full event details.
You can also see upcoming scheduled renewals by clicking Scheduled Renewals at the top of the page.
Renewal errors
When a renewal fails, the event appears with error status in the feed. Click View to see the detailed error message. Common examples:
| Error | Likely cause |
|---|---|
DigiCert reissue error: invalid_domain | The domain provided on the certificate has an invalid value for DigiCert |
Agent not found for tenant | The on-premises agent associated with the certificate is offline or was removed |
In addition to the feed, the CLM sends an automatic notification when a renewal fails, identifying the affected domain. Check your notification settings in Settings to make sure alerts are enabled.