Certificate lifecycle

This guide explains what a certificate chain is, how renewal and reissue differ, when revocation applies, and how to avoid an expired certificate.

Before you begin

Your SSL order number and the expiry date of the certificate.
Access to the place where the certificate is installed, such as the hosting panel or your VPS.

Steps

Understand the chain

The certificate for your site is signed by an intermediate authority, which is signed by a root authority.
Browsers need the intermediate certificates, the chain, to link your certificate to a trusted root. Install the chain with your certificate.

Renewal

Check the expiry date in your SSL order or in the panel. Start the renewal before the date.
Renew through the order or the Client Area, then install the new certificate in the same place as before.
Check the padlock again after the change.

Reissue

Reissue when you need a new certificate for the same names, for example after you lose the private key or change the server.
A reissue may need a new CSR and key. Follow Validation and CSR.

Revocation

Revocation cancels a certificate before it expires. Ask for it only if the private key was exposed or the certificate was issued wrongly.
After revocation, install a new certificate. Contact support if you are not sure whether to revoke.

An expired certificate causes browser warnings

When a certificate expires, browsers warn visitors and many will not open the site. Renew before the expiry date, not after.

Expected result

The certificate is valid for the domain, the chain is complete, and you know the next renewal date.

If something goes wrong

The browser says the certificate expired. Renew and install the new certificate at once. Read SSL warnings and errors.
The chain is incomplete. Install the intermediate chain from your order with the certificate.
You need to revoke a certificate. Contact support and explain why, including whether the private key was exposed.

Last reviewed

2026-10-27