Reissues vs. Renewals: Understanding Certificate Validity and Order Coverage
Shorter public TLS certificate lifetimes have created an important distinction between the validity of an individual certificate and the coverage period of the certificate order.
In CertCommand, this applies to every public TLS brand GeoCerts issues, including DigiCert, GeoTrust, Sectigo, and PositiveSSL. GeoTrust uses DigiCert’s issuance infrastructure. PositiveSSL uses Sectigo’s. An order can provide coverage for a longer period than any one certificate issued under that order. As certificates approach expiration, you can reissue them to use the remaining prepaid coverage. A renewal, by contrast, purchases a new coverage period.
As of September 2026, public TLS certificates from these brands can be issued for a maximum of 199 days. DigiCert and GeoTrust reached that limit on February 24, 2026. Sectigo and PositiveSSL followed the CA/Browser Forum date of March 15, 2026. This maximum will continue to decrease, and DigiCert usually implements the next industry date earlier than Sectigo. See the GeoCerts Change Log for current certificate lifetime limits.
Certificate validity vs. order coverage
These two dates serve different purposes:
| Term | What it means |
|---|---|
| Certificate validity | The period during which a particular issued certificate is valid and can be used by a server or application. |
| Order coverage | The prepaid period during which certificates can be issued or reissued under the order. |
| Reissue | Issues another certificate under the existing order and uses the remaining prepaid coverage. |
| Renewal | Purchases a new order coverage period. |
A certificate may therefore expire even though the underlying order still has months of coverage remaining. In that situation, you normally reissue, rather than renew, the certificate.
How reissues work
A reissued certificate receives a new validity period beginning on its issuance date. Its expiration date is whichever comes first:
- the current maximum certificate validity, or
- the order coverage expiration date.
Under the current 199-day limit, a reissued DigiCert, GeoTrust, Sectigo, or PositiveSSL certificate can therefore receive up to 199 days of validity when sufficient order coverage remains.
You do not have to wait for the current certificate to expire before reissuing it. Reissuing early can result in two or more certificates from the same order being valid at the same time.
Example: one order with three overlapping certificates
This example uses the current 199-day maximum, so the same dates apply to a DigiCert, GeoTrust, Sectigo, or PositiveSSL order issued in September 2026 or later. The renewal date in the timeline is the DigiCert and GeoTrust window described below.
First certificate
Certificate 1 is issued for the full 199-day maximum and expires Sep 18, 2026, long before the order coverage ends.
Reissue after ~100 days
Plenty of coverage remains, so Certificate 2 gets a fresh 199 days. Certificate 1 keeps working until Sep 18, giving you time to install and test the replacement.
Reissue near the end
Only 93 days of coverage remain, so Certificate 3 is shortened to end with the order on Mar 14, 2027. To go further, renew.
| Issued | Expires | Validity | |
|---|---|---|---|
| Order coverage | March 4, 2026 | March 14, 2027 | — |
| Certificate 1 | March 4, 2026 | September 18, 2026 | 199 days |
| Certificate 2 | June 12, 2026 | December 27, 2026 | 199 days |
| Certificate 3 | December 12, 2026 | March 14, 2027 | 93 days |
Day counts include the issue date.
A reissued certificate is valid for the current maximum validity or the remaining order coverage, whichever is shorter.
Does reissuing revoke the previous certificate?
Normally, no.
A standard reissue does not automatically revoke the certificate issued before it. Earlier certificates can remain valid until their own expiration dates, which is what makes overlapping certificates possible.
Removing a name or changing the common name revokes earlier certificates. If you reissue a certificate and remove a domain or SAN, or change the common name, any previous certificates on that order are revoked. (Adding a SAN does not revoke earlier certificates.) This applies to every CA. Install the replacement certificate before you submit that change.
Why is Reissue available but Renew is grayed out?
This is usually because the order still has prepaid coverage remaining.
For DigiCert and GeoTrust, a TLS order can be renewed up to 90 days before the order coverage expiration date. Before the order enters that renewal window, the Renew option may be unavailable even though Reissue is available. Sectigo and PositiveSSL also keep Renew unavailable until the order enters its renewal window. Use the date CertCommand shows on that order.
In the DigiCert and GeoTrust example above, the order coverage expires on March 14, 2027, so the renewal window begins on approximately December 14, 2026. Before then, the appropriate action for obtaining another certificate is generally Reissue.
Reissue uses time you have already purchased. Renewal purchases additional coverage.
Reissue vs. renew
| Reissue | Renew | |
|---|---|---|
| Uses the existing order? | Yes | No. Starts a new coverage period |
| Adds additional paid coverage? | No | Yes |
| Can be done before the current certificate expires? | Yes | Based on the order renewal window. DigiCert and GeoTrust open it 90 days before order coverage ends |
| Can overlap an existing certificate? | Yes | Yes, depending on issuance timing |
| Can extend beyond the current order coverage date? | No | Yes, because a new coverage period is purchased |
| Additional certificate charge for the existing coverage period? | No | Renewal pricing applies |
Validation during a reissue
A reissue is still a new certificate issuance. The issuing CA checks the required domain and organization validation before issuing the replacement certificate. That is DigiCert for a DigiCert or GeoTrust order, and Sectigo for a Sectigo or PositiveSSL order.
If the applicable validation has expired, the reissue may remain pending until validation is completed again. Shorter certificate lifetimes also mean validation must be performed more frequently than in the past.
What happens as certificate lifetimes get shorter?
The same concepts continue to apply as maximum certificate validity decreases.
An order may provide substantially more coverage than an individual certificate can use. You will therefore reissue certificates more frequently during the same order coverage period.
This is one reason certificate lifecycle automation is becoming increasingly important. Automated systems can request, validate, install, and replace certificates without requiring an administrator to manually repeat the process every time an individual certificate approaches expiration.
For ACME-managed DigiCert and GeoTrust certificates, the word renewal is sometimes used by the ACME client to describe obtaining a replacement certificate. Behind the scenes, DigiCert may process that request as a reissue on the existing order while prepaid coverage remains, and as a new renewal when the coverage period has ended. CertCommand ACME automation applies to DigiCert and GeoTrust, not to Sectigo or PositiveSSL.
See Understanding Automated Renewals and Auto-detection Rules for details.
Key takeaway
Think of the order coverage as the time you purchased and an individual certificate as one credential issued during that time.
Reissue gets you another certificate within the coverage you already own.
Renew purchases the next coverage period.
Because individual certificate lifetimes are now shorter than many order coverage periods, multiple reissues, and periods where two certificates are valid simultaneously, are normal and expected.
← Back to Order and Manage Certificates