---
title: "Renew certificates automatically · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/cryptography-and-keys/certificate-renewal
id: APS-102
level: Required
risk: outage
updated: 2026-10-27
build: a2a6bdfed830
tokens: 902
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Renew certificates automatically

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-102
- Level: Required
- Chapter: [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)
- Rule: Renew every certificate automatically, and get an alert when one has under 14 days left.
- Check: `certbot renew --dry-run` succeeds. The outside monitor alerts when any certificate has under 14 days left. A script compares the certificate list with the names the monitor watches and fails on any name missing from either.
- Risk: The app down or unusable
- How: Let an ACME client, such as certbot, renew on a timer and reload the server afterwards. Pick a client that follows ACME Renewal Information (RFC 9773), so the authority can ask for early renewal. Under CA/Browser Forum ballot SC-081, certificates issued since 15 March 2026 last at most 200 days. The cap goes from 200 to 100 days on 15 March 2027, and from 100 to 47 days on 15 March 2029. Manual renewal will not keep up. Keep one list of every certificate you depend on, with its owner and expiry, including internal service, client and code-signing certificates. Watch expiry from outside, together with the uptime check. Alert when any certificate has under 14 days left. ACME clients renew with about a third of the lifetime left, so an alert means renewal has failed for weeks. With 47-day certificates, renewal starts near 16 days, so lower the alert to about 7 days then.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
systemctl list-timers | grep certbot
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
```

## Sources

- [RFC 8555 (ACME)](https://www.rfc-editor.org/rfc/rfc8555)
- [RFC 9773 (ACME Renewal Information)](https://www.rfc-editor.org/rfc/rfc9773)
- [CA/Browser Forum Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/)

## Related rules

- OPS-42 [Warn before resources run out](https://agentwranglers.se/playbook/operations/capacity-and-resilience/exhaustion-alerts.md) in Operations and observability
- CMP-4 [Keep every legal date in one calendar](https://agentwranglers.se/playbook/compliance/scope-and-ownership/compliance-calendar.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/cryptography-and-keys/certificate-renewal">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Turn off old encryption](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/tls-configuration.md)
- Next: [Use only standard cryptography](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/standard-cryptography.md)
- [Cryptography and keys](https://agentwranglers.se/playbook/application-security/cryptography-and-keys.md)