Smarter SSL Certificate Reissue Timing with ACME Renewal Information (ARI)
Marcus KennedyShare
For years, automating an SSL Certificate has meant choosing a reissue schedule and trusting it. Your software reissues once a set portion of the validity period has passed, and as long as it runs on time, nothing expires. That approach is sound, and many operators rely on it today.
It is no longer the only way. Validity periods are shrinking, and a Certificate Authority (CA) sometimes needs a reissue brought forward at short notice. A newer part of the Automatic Certificate Management Environment (ACME) protocol, ACME Renewal Information (ARI), adds the option of letting the Certificate Authority (CA) advise the timing instead.
Reissuing on a Fixed Schedule
The common approach lets the ACME client decide the timing on a fixed rule, such as reissuing once about a third of the validity period remains, or a set number of days before expiry. The client checks each day and acts when the threshold is crossed. The date is predictable, which many operators prefer.
The trade-off is that the client only knows what it can see. It cannot bring a reissue forward for a reason the Certificate Authority (CA) holds but has not shared, and a batch issued on the same day tends to reissue together. For most operators neither point is a problem, and a fixed schedule remains a sound choice.
Why ARI Exists
Two developments explain why ARI was added to the standard. The first is the steady fall in how long an SSL Certificate may last.
The maximum validity period has already dropped to 200 days, and it falls again to 100 days and then to 47 days by 2029. Reissues that once happened yearly now happen several times a year. Learn About The Shorter Validity Periods 🔗
The second is the mass replacement event. When a Certificate Authority (CA) has to withdraw a group of SSL Certificates at short notice, every affected site needs a fresh one before a deadline, and a fixed schedule cannot react because the client never hears about it. Learn About A Mass Revocation Event 🔗
How ARI Works
ARI, defined in the standard as RFC 9773, adds one address to the ACME directory. Your software reads that address to ask the Certificate Authority (CA) when a given SSL Certificate should be reissued, rather than working it out alone.
The answer is a window, a start time and an end time, and your software picks a moment inside it. If the Certificate Authority (CA) needs one sooner, it moves the window earlier, and compliant software follows on its next check. Learn About How ARI Works in Detail 🔗
One point on wording : the standard calls this renewal, but the action is a reissue. A fresh SSL Certificate is issued inside your existing license, and the license itself is not replaced.
Choosing a Strategy and a Client
There is no single correct way to time a reissue. A fixed interval keeps a known, predictable date and is the common, sound choice, while ARI hands the timing to the Certificate Authority (CA) for operators who would rather it advise when to act. Neither is better in the abstract.
Because the strategy decides the behavior, it also decides the client. ARI works only where the ACME client supports RFC 9773 and is set to use it.
Choosing a client, or building your own, is where you confirm it does what you want, or can be configured or coded to suit. That decision sits with whoever installs and manages the automation, and with the security goal each site is working toward.
Where Trustico® Fits
The role of Trustico® is to provide the license and the credentials for it. Which ACME client or custom solution you run, whether you use ARI, and how you request and reissue your SSL Certificates are yours to decide.
A Certificate as a Service (CaaS) subscription is built around that freedom rather than one fixed method. The complimentary scripts, plugins and services that Trustico® offers are one convenient option among many, not a requirement. Explore Certificate as a Service (CaaS) 🔗
Those Trustico® tools can follow a fixed interval or ARI, and some also check each day that the SSL Certificate is installed and serving correctly. That extra check is one strategy rather than a rule, wanted by some operators and not others, and the tools can be configured, or redeveloped, to match.
Tip : Pick the combination that fits. A fixed interval, ARI, or either one paired with a daily check that the SSL Certificate is live are all valid, and a Certificate as a Service (CaaS) subscription leaves the choice to you.
Use them, pick another client, or write your own. Beyond the credentials, the approach is entirely yours.
Getting Started
Whichever way you choose to time a reissue, make sure your ACME client matches it, and confirm it supports ARI if that is the route you want. Learn About Supported ACME Clients 🔗
From there, a single Certificate as a Service (CaaS) subscription covers unlimited reissues for your domains, however you choose to time them. View Our Certificate as a Service (CaaS) SSL Certificates 🔗
