Certificate Management Service:SSL certificate renewal and expiration

Renewal process

Renewing an SSL certificate means reissuing a new certificate, not extending the validity period of the original one. After the new certificate is issued, the original certificate remains valid until it expires. The renewal process is as follows:

1. Submit renewal information and complete payment: Complete and submit the required renewal information, and then complete the payment.

2. Submit the certificate request: Submit a new certificate request to a certification authority (CA). You must validate your domain ownership and cooperate with the CA to complete the review.

3. Deploy and verify the new certificate: Deploy the newly issued certificate to your server or cloud service to replace the original one.

Prerequisites

• Certificate Status: Pending Expiration

• Certificate type: Not a multi-domain certificate.

• Specification changes: No changes to certificate specifications (such as brand or type) are needed.

Validity period calculation for the new certificate

To ensure a smooth transition, a renewed and reissued certificate carries over the remaining validity period of the original certificate, up to a maximum of 30 days.

• Calculation rule

  • Formula: New certificate validity period = Standard validity period (12 months or 365 days) + Remaining validity period of the old certificate (up to 30 days).

  • Expiration date: If you complete the renewal and issuance process within 30 days before the original certificate expires, the new certificate's expiration date is fixed (original certificate's expiration date + 365 days).

• Scenarios

  For example, consider a certificate that is valid from 2024-10-01 to 2025-09-30. Assume the new certificate is issued on the same day the application process starts.

  • Operation time: Submit renewal request on 2025-09-10.

  • Follow-up action: Manually submit the certificate request.

  • New certificate validity period: 12 months (365 days) + 20 days (remaining validity of old certificate) = 385 days.

  • New certificate validity range: 2025-09-10 to 2026-09-30.

  Note

  For the system to automatically start the certificate application process through the Managed Service, the following conditions must be met. Otherwise, you must submit the request manually.

  • For a DV certificate, the Alibaba Cloud account that uses Alibaba Cloud DNS for the domain name must be the same as the account that purchased the certificate, or the domain name must have validation-free authorization completed.

  • The certificate application information and materials are valid, as determined by the CA.

Step 1: Submit renewal information and complete payment

1. Go to the SSL Certificate Management page. On the Official Certificate tab, find the certificate that you want to renew, and in the Actions column, click Renewal purchase.

2. In the Certificate renewal panel, enter the following information.

   • CSR Generation:

     A Certificate Signing Request (CSR) is a file used to request a certificate from a Certificate Authority (CA). It contains the domain name for the certificate, the public key, and entity information, and is signed with your private key. We recommend that you use Automatic.

     Automatic

     The system generates and securely hosts a new key pair with the same key algorithm as the original certificate and uses it to create a new CSR.

     Note

     This method follows the security best practice of key rotation.

     Manual Entry

     If you use a CSR file generated in your own environment, paste the file content into the CSR File field. Certificates issued using this method cannot be deployed to Alibaba Cloud products through the console. For more information about creating a CSR file and a private key file, see Create a CSR file.

     Important

     • If the encryption algorithm of the manually entered CSR does not match the Key Algorithm of the old certificate, you cannot submit the certificate for review.

     • Keep your private key file in a safe place. Alibaba Cloud is not responsible for storing your private key. If the private key is lost, you must purchase a new SSL certificate.

     Update with Original Key

     Use the key pair from the original certificate to generate a new CSR file and issue a new certificate.

     Important

     This method does not follow key rotation best practices and may not meet the compliance requirements of some industries.

   • Domain Verification Method:

     By default, this is the same as the validation method of the original certificate.

     DV certificates

     The process differs depending on whether the account that purchased the certificate is the same one used for DNS resolution.

     The certificate and the domain name DNS are not under the same Alibaba Cloud account

     • Manual DNS Verification (Recommended): Log on to your domain name resolution service platform and add a TXT DNS record.

     • File Verification: Log on to your web server, and then create and upload the required validation file to the specified folder.

       Important

       Wildcard domain names do not support file validation.

     The certificate and the domain name DNS are under the same Alibaba Cloud account

     The system uses the Automatic DNS Verification method. Alibaba Cloud automatically adds a DNS record to the corresponding domain name in the Alibaba Cloud DNS console to verify domain ownership. No manual operation is required.

     OV certificates

     After you submit an OV certificate request, the CA sends domain ownership validation instructions to the contact by email or phone. The contact must complete the validation as required to confirm domain ownership.

     EV certificates

     After you submit an EV certificate request, the CA sends domain ownership validation instructions to the contact by email or phone. The contact must complete the validation as required to confirm domain ownership.

   • Contact:

     Depending on the domain validation method, the CA may send a certificate validation email to this contact or communicate with them about the review using their mobile phone number . Make sure the contact information is accurate and valid.

   • Renewal Period:

     1 Year

     • Includes: One SSL certificate of the same specifications with a 1-year validity period.

     • Application process: After renewal, you must manually submit the certificate request from the certificate list.

     2 Years

     • Includes: Two SSL certificates of the same specifications, each with a 1-year validity period, and one use of the Managed Service.

       Note

       The Managed Service includes automatic certificate requests before expiration , carrying over the remaining validity period (up to 30 days), and dedicated technical support.

     • Application process:

       • First certificate: After renewal, you must manually submit the certificate request from the certificate list.

       • Second certificate: When the first certificate has 30 days or less of remaining validity, one use of the Managed Service is automatically consumed to start the application process for the second certificate.

       Note

       For the system to automatically start the certificate application process through the Managed Service, the following conditions must be met. Otherwise, you must submit the request manually.

       • For a DV certificate, the Alibaba Cloud account that uses Alibaba Cloud DNS for the domain name must be the same as the account that purchased the certificate, or the domain name must have validation-free authorization completed.

       • The certificate application information and materials are valid, as determined by the CA.

     3 Years

     • Includes: Three SSL certificates of the same specifications, each with a 1-year validity period, and two uses of the Managed Service.

       Note

       The Managed Service includes automatic certificate requests before expiration , carrying over the remaining validity period (up to 30 days), and dedicated technical support.

     • Application process:

       • First certificate: After renewal, you must manually submit the certificate request from the certificate list.

       • Subsequent certificates: When the previous certificate has 30 days or less of remaining validity, one use of the Managed Service is automatically consumed to start the application process for the new certificate.

       Note

       For the system to automatically start the certificate application process through the Managed Service, the following conditions must be met. Otherwise, you must submit the request manually.

       • For a DV certificate, the Alibaba Cloud account that uses Alibaba Cloud DNS for the domain name must be the same as the account that purchased the certificate, or the domain name must have validation-free authorization completed.

       • The certificate application information and materials are valid, as determined by the CA.

3. Click Renewal immediately and follow the prompts to complete the payment.

   • Payment rule: The system first uses your remaining certificate quota for the same specifications and your remaining Managed Service uses to offset the cost. You must pay for any shortfall.

   • View remaining certificate quota and managed service usage: Go to the SSL Certificate Management page, and on the Official Certificate tab, click Create Certificate.

     • Remaining Managed Service Count: The number of remaining managed services. This value is displayed next to Available Quota for Hosting Service: in the Validity Period (Years) field.

     • Remaining Certificate Quota: After you select a Certificate Type, you can click the Certificate Specifications drop-down list to view the remaining certificate quota for each specification. This quota is displayed as "Number of certificates that can be requested".

4. After the renewal is complete, the certificate status for different renewal periods is as follows:

   1 Year

   A new certificate is generated below the original certificate. It is associated with the original certificate, is marked with an icon on the left, and has a status of Pending Application. The validity period of the original certificate remains unchanged.

   2 Years

   Two new certificates associated with the original one are generated below it. The new certificates have an icon on the left to indicate their association. The validity period of the original certificate is not affected.

   • The status of the first certificate is Pending Application.

   • The status of the second certificate is Not Activated.

     Note

     If you cancel a Not Activated certificate, your certificate and managed service quotas are restored. To reuse these quotas, follow the instructions in Create an SSL Certificate.

   3 Years

   Three new certificates associated with the original one are generated below it. The new certificates have an icon on the left to indicate their association. The validity period of the original certificate is not affected.

   • The status of the first certificate is Pending Application.

   • The status of the 2nd and 3rd certificates is Not Activated.

     Note

     If you cancel a Not Activated certificate, your certificate and managed service quotas are restored. To reuse these quotas, follow the instructions in Create an SSL Certificate.

Step 2: Submit the certificate request

The next step depends on the certificate's status:

• Not Activated: When the current certificate expires in 30 days or less, the managed service automatically initiates the certificate application process.

• Pending Application: Submit a request to the certification authority (CA) and complete domain ownership verification.

• Validating Application: The application has been submitted to the certificate authority (CA). Follow the instructions in Handle CA review results to complete the certificate issuance.

Step 3: Deploy and verify the new certificate

1. Deploy the certificate.

   • Confirm the status of the managed deployment task.

     If the previous certificate was deployed to an Alibaba Cloud service (such as ALB, WAF, CDN, or DDoS) and a managed deployment task was automatically created for the current certificate, follow these steps to view the task details and confirm the deployment result:

     • Go to the Hosted Deployment for Cloud Services page.

     • In the Certificate Resource ID column, find the deployment task that corresponds to the Resource ID of your certificate. You can find this ID in the Certificate column of the certificate list.

     • To view the progress and other details of the task, click Details in the Actions column.

     Note

     After the current certificate is issued, the system deploys it through Managed Deployment for Cloud Services. If the deployment fails, the system sends a notification by email and internal message.

   • Manually deploy to the destination server.

     For more information, see Select a deployment solution for an SSL certificate. Deploy the new certificate to your web application server or cloud service to replace the original one.

2. Verify the certificate.

   1. In a browser such as Chrome, enter https://domain_name in the address bar and access the website.

   2. Click the icon, and then click Connection is secure > Certificate is valid in the pop-up panel.

   3. In the panel that appears, check General > Expires On. The new certificate is deployed successfully if the date matches the expiration date of the new certificate.

Renewal basics

Renewal operation issues

Post-renewal deployment issues

Emergency handling for expired certificates