ACME Automation Certificate Renewal: How Often?

You should renew ACME Automation certificates at least every 90 days, and ideally every 30 to 60 days, depending on your risk tolerance and operational needs. This article explains the reasoning behind these intervals, how ACME Automation’s renewal process works, and how to choose the right schedule for your environment.

Formula

The calculator above helps you plan your next renewal by comparing your certificate’s current age (t, in days) with your chosen renewal interval (r, in days). The formula for days until renewal is:

Days until renewal = r – t

And the percentage of the interval already elapsed is:

Age as % of interval = (t / r) × 100

Both variables are measured in days. The result tells you how many days you have left before you should trigger a renewal, and how close you are to the end of your planned cycle.

Worked Example

Using the default values from the calculator: a certificate that is 45 days old, with a renewal interval of 60 days.

1. Days until renewal = 60 – 45 = 15 days
2. Age as % of interval = (45 / 60) × 100 = 75%

So with a 60-day renewal cycle, you would renew in 15 days, when the certificate reaches 75% of its planned lifetime. This matches the calculator’s output.

Background: Why Certificate Renewal Frequency Matters

ACME Automation is a tool that automates the issuance and renewal of SSL/TLS certificates, commonly used with Let’s Encrypt and other ACME-based certificate authorities. The core reason to renew frequently is that certificates have a limited lifetime—typically 90 days for Let’s Encrypt, but some CAs issue certificates valid for up to 13 months. If a certificate expires, users see security warnings, and automated services may stop working. Renewing well before expiry avoids these disruptions.

Another reason for shorter renewal cycles is security. A certificate that is compromised can be used to impersonate your domain. The shorter the validity period, the smaller the window of exposure if a private key is leaked. This is why many security experts recommend a 30- to 60-day renewal cycle, even though the maximum validity might be longer.

How ACME Automation Renewal Works

ACME Automation typically runs as a client on your server. It checks the current certificate’s expiration date and, if it is within a certain threshold (e.g., 30 days before expiry), it automatically requests a new certificate from the CA. The process involves:

• Validation: The CA verifies that you control the domain, usually via HTTP-01 (placing a file on your web server) or DNS-01 (adding a TXT record).
• Issuance: The CA issues a new certificate and sends it to your ACME client.
• Installation: The client replaces the old certificate and reloads the web server or application.

Most ACME clients, including the one used by ACME Automation, have a built-in renewal timer. You can set the renewal threshold (e.g., 30 days before expiry) or a fixed interval (e.g., every 60 days). The client will automatically renew when the condition is met.

How to Choose Your Renewal Interval

There is no one-size-fits-all answer, but here are factors to consider:

• Certificate validity period: If your CA issues 90-day certificates, you must renew at least every 90 days. Choose a shorter interval to have a safety margin.
• Operational tolerance for downtime: If a renewal fails, you might have to intervene manually. A shorter interval means more frequent renewals, but each one is less critical because you have more time to fix issues.
• Security posture: If you handle sensitive data, a 30-day renewal limits the impact of a key compromise.
• Automation reliability: If your renewal process is fully automated and tested, you can safely use a 60-day interval. If it sometimes fails, use 30 days to have more chances to catch problems.

A common practice is to set the renewal to trigger at 30 days before expiry, which for a 90-day certificate means renewing every 60 days. Some organizations prefer every 45 days to have a buffer.

Common Problems and Misconceptions

Misconception: Renewing too often causes rate limits. ACME CAs like Let’s Encrypt have rate limits on certificates issued per domain per week, but renewing every 30 days is well below that limit. You can safely renew every 30 days without hitting rate limits.

Problem: Renewal fails due to validation errors. This often happens when the HTTP-01 challenge can’t be served because the web server is down or the DNS record hasn’t propagated. To avoid this, ensure your server is reachable and DNS is stable.

Problem: The certificate is renewed but not installed. Some ACME clients only replace the certificate file but don’t reload the web server. Check your client’s configuration to ensure it runs a reload command after renewal.

Problem: Timezone confusion. Certificates have an exact expiration time, not just a date. Always renew based on the actual expiration timestamp, not the local date.

Cost and Safety Considerations

ACME Automation itself is free to use, and certificates from Let’s Encrypt are also free. Some commercial CAs offer paid certificates with longer validity or additional features, but the automation process is the same. The main cost is the time to set up and maintain the automation.

Safety-wise, always ensure your private keys are stored securely and are not exposed in logs. When renewing, the new key is generated on the server; make sure your server is not compromised. Also, monitor your renewal logs to catch failures early.

Alternatives to ACME Automation

If you are not using ACME Automation, there are other tools that automate certificate renewal, such as Certbot, acme.sh, and cloud provider-specific solutions. These work similarly: they use the ACME protocol to obtain certificates and handle renewal automatically. The renewal frequency recommendations are the same regardless of the tool.

Frequently Asked Questions

Can I renew a certificate more than once a day?

Technically, you can, but it’s unnecessary and may hit rate limits. Let’s Encrypt allows up to 5 duplicate certificates per week per domain. Renewing once a day would exceed that. Stick to a reasonable interval like 30-60 days.

What happens if I don’t renew before expiration?

Your certificate will expire, and browsers will show a security warning. Automated services that rely on the certificate may stop working. You can still renew after expiration, but there will be downtime and potential data loss.

Does ACME Automation renew certificates automatically without my intervention?

Yes, if configured correctly. The client runs on a schedule (e.g., daily) and renews when the certificate is within the renewal threshold. You only need to intervene if the renewal fails.

What is the best renewal interval for a 90-day certificate?

Most experts recommend renewing at 60 days (i.e., 30 days before expiry) to have a safety margin. If you want extra security, renew every 45 days. Avoid waiting until the last week.

Can I set a custom renewal threshold in ACME Automation?

Yes, most ACME clients allow you to specify the number of days before expiry to trigger renewal. You can also set a fixed number of days between renewals, depending on the client’s features.

Does renewing more often affect website performance?

No, the renewal process is lightweight and does not impact performance. It only involves a few HTTP requests and a server reload, which takes milliseconds.

Related

• Run ISO Files from HDD with GRUB2
• File comparison tools for Linux: top 5 compared
• Flock Camera Contract Ends: What Towns Should Do Next

in t | Current certificate age (days) | days | 45 | 0
in r | Renewal interval (days) | days | 60 | 1
out next | Days until next renewal | days | r - t | 0
out pct | Age as % of interval | % | (t / r) * 100 | 1