ACME Renewal Information (ARI) and SSL Certificate Reissue Timing

Every Trustico® Certificate as a Service (CaaS) license connects to an Automatic Certificate Management Environment (ACME) endpoint, and that endpoint can tell your software when to reissue each SSL Certificate. The feature that carries this advice is ACME Renewal Information (ARI), and it takes the guesswork out of reissue timing.

Most software reissues on a fixed rule it decides for itself. ARI moves that decision to the Certificate Authority (CA), the party that actually knows when an SSL Certificate should be replaced. This page explains what ARI is, how the renewalInfo address works, and how Trustico® uses it.

What ARI Is

ARI is a small extension to the Automatic Certificate Management Environment (ACME) protocol, defined in RFC 9773. It adds one address to the directory, named renewalInfo, that your software reads to learn the best time to reissue an SSL Certificate.

The standard uses the word renewal, and the directory field is named renewalInfo, but at Trustico® the action is a reissue. A fresh SSL Certificate is issued inside your existing license, and the license itself is never replaced, so reissue is the term used throughout.

Without it, an ACME client reissues on a fixed rule of its own, often once about a third of the validity period remains. ARI replaces that rule with advice from the Certificate Authority (CA), which can see reasons to act sooner than any fixed schedule would. Learn About The ACME Protocol 🔗

Where renewalInfo Sits in the Directory

Every ACME endpoint returns a directory document, a short list of addresses your software reads first. The renewalInfo address is one entry in that list, alongside the addresses for creating an account, placing an order and revoking an SSL Certificate.

On the Trustico® Domain Validation (DV) endpoint, the directory carries a renewalInfo address on its own host.

{
  "newOrder": "https://acme.trust-provider.com/v2/TrusticoDV/newOrder",
  "revokeCert": "https://acme.trust-provider.com/v2/TrusticoDV/revokeCert",
  "renewalInfo": "https://ari.trust-provider.com/renewalInfo",
  "keyChange": "https://acme.trust-provider.com/v2/TrusticoDV/keyChange"
}

Every Trustico® and Sectigo® product line carries the same renewalInfo entry, with the Sectigo® endpoints pointing at their own host. Your software reads the address straight from the directory, so there is nothing for you to set up. Learn About ACME Endpoints Explained 🔗

How Your Software Uses renewalInfo

The exchange is a plain read that needs no login, and your software runs it for you. Knowing its shape helps you understand what your client is doing on each run.

Asking the Certificate Authority

Your software builds a short identifier for the SSL Certificate from two values already inside it, the Authority Key Identifier (AKI) and the serial number. It asks renewalInfo about that identifier, which tells the Certificate Authority (CA) exactly which SSL Certificate is in question.

Reading the Suggested Window

The Certificate Authority (CA) replies with a suggested window, a start time and an end time between which it recommends the reissue. Your software picks a moment at random inside that window and reissues then.

Choosing a random moment spreads the work out, so a batch of SSL Certificates issued together does not all reissue at the same instant. The reply can also carry an explanation address, which your software passes on to you.

Checking Again Over Time

Until the window arrives, your software asks again at an interval the Certificate Authority (CA) sets in each reply. If the Certificate Authority (CA) moves the window earlier, your software sees the change on its next check and reissues sooner, with nothing required from you.

Why the Certificate Authority Sets the Timing

Letting the Certificate Authority (CA) choose the window matters most when an SSL Certificate has to be replaced ahead of schedule.

The clearest case is a mass revocation. When a group of SSL Certificates must be replaced quickly, the Certificate Authority (CA) shortens the window, and compliant software reissues well before the deadline instead of each operator finding out by hand.

It also smooths load. As maximum validity periods fall to 200 days, then 100, then 47 by 2029, reissues happen far more often, and ARI lets the Certificate Authority (CA) spread a surge so it does not all land at once. Learn About The Shorter Validity Periods 🔗

How Trustico® Uses ARI

The Trustico® endpoints publish a renewalInfo address in every directory, so any ACME client that supports RFC 9773 can read it and act on it. The complimentary scripts, plugins and services that Trustico® configures go one step further.

Those tools check each SSL Certificate once a day, whatever the suggested window says. ARI tells your software when a reissue is due without constant guessing, but a daily check does something ARI alone does not.

A daily check also confirms that the SSL Certificate is installed and serving correctly, not only that it is current. A reissue that never reached the server, or a service that did not reload, is caught the same day rather than at the next expiry.

This is why Trustico® keeps the daily check even where ARI is available. The two complement each other : ARI sets the timing, and the daily run guards the result. Explore Certificate as a Service (CaaS) 🔗

Getting Started

ARI needs nothing from you to switch on. Any ACME client that supports RFC 9773 reads the renewalInfo address from the directory and follows it, and the Trustico® cPanel Plugin, hosted tool and other services already do. Learn About Supported ACME Clients 🔗

If you are choosing how to automate, a Certificate as a Service (CaaS) license gives you the endpoint, the credentials and the reissue timing in one place. View Our Certificate as a Service (CaaS) SSL Certificates 🔗