Keep HTTPS working

Renew, install, verify.

A renewal replaces a certificate. Your annual management subscription does not extend the certificate already installed on your server.

For a supported automatic setup

Your native server client should renew and install replacements when due. Check its task/timer, validation path and logs; verify the actual served certificate after renewal. A task launch alone is not proof. Start with IIS, Apache or Nginx automatic setup.

Keep your dashboard current

After native setup, enable “Track the certificate served over public HTTPS” for your domain in the dashboard. Account activity refreshes eligible checks at most every 15 minutes. Daily checks require the operator to enable scheduled processing. A trusted replacement becomes the live certificate; saved history and portal packages remain available.

Enable email notifications separately. Live-managed expiry reminders require a recent verified observation. If HTTPS is unreachable or untrusted, review your server and renewal logs; this is not proof that renewal failed. A check observes one public endpoint at one time and does not install anything or recover a private key.

Why frequent replacement is a security benefit

Short validity limits the window for misuse after a key is stolen or a certificate is issued incorrectly. Automation makes that replacement practical. An annual management plan is separate from the certificate's actual expiry. Certificate lifetime security rationale.

Manual download and recovery fallback

1. Check the expiry and coverage

   Open your dashboard and confirm the exact names, current certificate expiry and server. Allow time for domain verification and installation; do not wait until the last day.

2. Request a replacement

   Choose “Renew this certificate” or request certificate setup for the domain. Review the hostname or wildcard coverage and key profile. Complete any requested DNS verification without deleting unrelated DNS records. A request or reminder alone does not mean issuance is complete.

3. Download the issued production package

   After issuance, choose IIS PFX or Apache/Nginx PEM ZIP. Supply a fresh authenticator code and a new package password. Keep that password separately. Staging certificates are not publicly trusted.

4. Install it on every TLS endpoint

   Back up the working configuration first. Follow the relevant server guide below. Update each intended binding, virtual host, proxy or load balancer; downloading the replacement does not update any server automatically.

5. Verify the certificate actually served

   From another device, check every HTTPS hostname without bypassing warnings. Confirm the intended page, expected fingerprint, names and new expiry. Check DNS/IPv6/CDN destinations and unrelated sites as appropriate.

6. Keep a protected rollback

   If checks fail, restore the previous working configuration while it remains valid. Retain your encrypted recovery package securely and remove obsolete transfer copies according to your policy. Confirm your reminder contact details remain current.

Renewal and billing FAQs · Request quoted assistance · Your certificates