Renewals

Automated renewals are the main reason most teams adopt ACME—but they often behave differently than customers expect. A single certificate order can span years of prepaid coverage, while each issued certificate may be valid for only weeks or months. The client and DigiCert keep replacing the certificate automatically through reissues (and, when applicable, renewals) on that same order—you do not run separate renew or reissue commands.

This section explains how that automation works and how to configure it.

Acronyms used on this page

Term	Meaning
ACME	Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ARI	ACME Renewal Information — optional CA-directed schedule for when to renew a certificate
CA	Certificate Authority — DigiCert, which issues your certificates and provides renewal timing via ARI
CLI	Command-Line Interface — run `dc-acme request enroll` with explicit flags instead of loading settings from `dc-acme.toml`
TOML	Tom's Obvious, Minimal Language — the config file format used by `dc-acme.toml`
DCV	Domain Control Validation — proof that you control a domain name (via a DNS-01 or HTTP-01 challenge)

Orders, coverage, and reissues

When you create an ACME Directory URL, you choose a multi-year prepaid coverage term (1, 2, or 3 years). That term is how much certificate time you purchase up front—not how long any single certificate file stays valid on disk.

Term	What it means
Prepaid coverage term	How long the CertCentral order remains active (1, 2, or 3 years minimum)
Certificate validity	How long each issued certificate is valid (for example, 60 days—subject to industry limits)
Reissue	A replacement certificate on the same order while prepaid coverage remains. No additional charge—the reissue uses time left on that order’s coverage term. DCV runs again; the client installs the new files
Renewal	Starts a new prepaid coverage term and involves payment for the next 1-, 2-, or 3-year period (typically a new billable order). Distinct from a reissue in DigiCert’s order actions

During a 1-, 2-, or 3-year coverage term, expect multiple automatic reissues as certificates expire and industry validity periods shorten. That is normal—you are not placing a new order each time.

You do not choose renew vs. reissue. The DigiCert ACME Client submits certificate requests; DigiCert’s auto-detection rules decide whether each request is treated as a reissue, renewal, or new enrollment. Enable automation once; the background service and CA handle the rest.

Use ARI for production. ACME Renewal Information (ARI) lets DigiCert tell the client when to reissue—adapting as certificate lifetimes shorten. Set auto_ari_renew = true in TOML and confirm a non-zero acmeAriId after enroll. The older auto_renew_days fixed-window approach (“renew 30 days before expiry”) is a legacy fallback only when ARI is off—not recommended for new production automation.

In this section

Understanding Automated Renewals

How the background service drives reissues and renewals, ACME Renewal Information (ARI), eligibility rules, and what dc-acme request list does and does not show.

Understanding Automated Renewals »

Renewal Timing and Configuration

[service] settings in dc-acme.toml—ARI (recommended) vs. legacy fixed-window—and production vs. sandbox enroll behavior.

Renewal Timing and Configuration »

Key points upfront

Production: enable ARI — set auto_ari_renew = true in TOML and enroll with --use-default-config. Each certificate gets an ARI job (non-zero acmeAriId in request list). DigiCert directs reissue timing; you do not pick a day count.

TOML `auto_ari_renew`	What registers	`request list` signal
`true` (recommended)	ARI job — CA-directed reissue timing	Non-zero `acmeAriId`
`false` (legacy / sandbox)	Fixed window — `auto_renew_days` only	`acmeAriId`: 0

Defaults are conservative. New installs ship with auto_renew = false and auto_ari_renew = false in dc-acme.toml—enable auto_ari_renew = true for production hosts.
Legacy fixed-window: auto_renew + auto_renew_days (“renew ~N days before expiry”) predates ARI and does not adapt as lifetimes shrink. It applies only when auto_ari_renew = false. GeoCerts does not recommend it for new production deployments.
CLI-only enrolls: omitting --auto-ari-renew registers an ARI job; pass --auto-ari-renew=false for sandbox one-shot enrolls
Config-based enrolls: TOML auto_ari_renew controls ARI; CLI renewal flags do not override TOML
dc-acme request list does not show the next reissue date. Use CertCommand (Certificates > Orders) for expiration dates. Check acmeAriId to confirm ARI is registered.

If you have not yet configured dc-acme.toml, complete Configuration (dc-acme.toml) first.

Next step