Use the certificate authority’s suggested ACME Renewal Information (ARI) window whenever both your CA and ACME client support it. Let’s Encrypt recommends checking ARI for each certificate at least twice a day. That polling schedule does not mean issuing a replacement twice daily: the client renews when the CA’s window says it should. If ARI is unavailable, use a lifetime-based fallback—normally when one-third of the certificate’s total validity remains, or halfway through the lifetime for certificates valid for fewer than 10 days.
For a current 90-day Let’s Encrypt certificate, that fallback works out to 30 days before expiration. It is a Let’s Encrypt recommendation, not a universal ACME rule. Your certificate lifetime, CA, client implementation and deployment ownership all affect the correct schedule.
As an Amazon Associate I earn from qualifying purchases.
The practical renewal schedule
| Situation | What to configure | What it means |
|---|---|---|
| ARI supported by the CA and client | Check each certificate’s ARI information at least twice daily, following the CA’s suggested window | The CA supplies certificate-specific timing |
| ARI unavailable | Renew automatically with one-third of the certificate lifetime remaining | A lifetime-based fallback recommended by Let’s Encrypt |
| Certificate lifetime under 10 days | Renew at roughly halfway through the lifetime | Let’s Encrypt’s special short-lifetime fallback |
| Current 90-day Let’s Encrypt certificate without ARI guidance | Begin renewal about 30 days before expiration | One-third of 90 days; not a universal ACME interval |
Always keep a recurring client check running, then let the applicable ARI window or fallback rule decide whether to place a new order. A successful check is not the same as a successful renewal, so deployment and expiry monitoring are separate responsibilities.
What ARI changes about renewal timing
ACME Renewal Information is an extension standardized as RFC 9773. It allows a CA to suggest a renewal window for a particular certificate instead of forcing every certificate into one fixed day-count schedule. Let’s Encrypt describes ARI as the preferred way to determine when to renew and says its clients should check the information for each certificate at least twice a day.
#1 Best Overall
“We recommend checking ACME Renewal Information for each certificate at least twice a day.”
The check is a lightweight decision step: the client asks whether the certificate is inside the CA’s suggested window and renews when appropriate. It should not blindly request a replacement on every poll. Polling twice daily therefore improves responsiveness to a CA’s window without creating twice-daily certificate orders.
Both sides must support ARI
ARI only helps when the ACME server exposes it and the client understands it. Check the documentation and release notes for your specific CA and client rather than assuming that an ACME-compatible endpoint automatically implements every extension. If either side lacks ARI, use the lifetime-based fallback and retain a frequent scheduled check.
Free tools Windows power users keep installed
One-click scans. No signup required.
ARI is certificate-specific
The suggested window can differ between certificates. Treat the ARI response associated with each certificate as authoritative for that certificate, rather than copying one renewal date across all domains, accounts or environments. A client managing many certificates should evaluate them individually during its scheduled run.
Rank #2
Fallback timing when ARI is unavailable
Let’s Encrypt’s integration guidance states: “As a backstop to ARI, we recommend renewing certificates automatically when they have a third of their total lifetime left.” This is a proportion, not a fixed number of days. It remains meaningful if a CA changes its certificate lifetime.
Calculate one-third of the lifetime
- Determine the certificate’s total validity period from its issued and expiry timestamps.
- Divide that lifetime by three.
- Start automatic renewal when that amount of validity remains.
- Continue checking on your recurring schedule until the replacement is issued and deployed.
For a 90-day certificate, one-third is 30 days, so the fallback point is 30 days before expiration. For illustration, applying the same proportion to a 180-day certificate would put the fallback at 60 days remaining. That arithmetic does not make one-third a universal ACME mandate; it reflects the Let’s Encrypt backstop and should be replaced by your CA’s documented policy when one exists.
Certificates shorter than 10 days
For a validity period under 10 days, Let’s Encrypt recommends renewing halfway through the lifetime rather than waiting for one-third remaining. A seven-day certificate would therefore reach the fallback point with about three and a half days left. Use the actual validity timestamps and preserve enough time for validation, issuance, installation and recovery from a failed attempt.
Why ACME does not impose one universal interval
ACME defines the protocol, not a single renewal calendar for every certificate. RFC 8555, published by the IETF in March 2019, describes certificates as immutable resources. When a client needs a renewed certificate, it initiates a new order rather than modifying the existing certificate in place.
That model leaves timing to the CA’s policy, any ARI guidance, the certificate’s lifetime and the client’s scheduling configuration. A rule such as “renew 30 days before expiry” is therefore safe only when it matches the specific 90-day certificate and the relevant CA recommendation. It should not be copied to certificates with different lifetimes or treated as an ACME standard.
How to configure an ACME renewal job
The exact labels and commands depend on the client, operating system and CA. The following procedure is implementation-neutral and keeps the timing decisions in the right place.
- Confirm the certificate owner. Identify which ACME client holds the account key and certificate private key, and which system installs the resulting certificate. Do not assume that a hosting, cloud or load-balancing service renews a certificate merely because it stores one.
- Check ARI support. Verify that the CA endpoint and your client implement ARI. If they do, enable the client’s ARI-aware renewal mode and ensure it evaluates each certificate separately.
- Create a recurring check. Run the client at least twice daily when following Let’s Encrypt’s ARI guidance. Cron jobs and systemd timers are common scheduling mechanisms; use the scheduler appropriate to your platform.
- Set the fallback. If ARI is not available, configure the client to renew at one-third of total lifetime remaining, or halfway through for a certificate valid less than 10 days. Avoid hard-coding 30 days unless the certificate is the current 90-day Let’s Encrypt type for which that calculation applies.
- Automate installation. After issuance, copy or deploy the new certificate and private key to every terminating service—such as a web server, reverse proxy or load balancer—then perform the service’s required reload or restart.
- Verify the live endpoint. Confirm that the endpoint presents the new certificate, includes the expected names and chain, and has a later expiry date. Checking only the client’s local certificate file can miss a failed deployment.
- Record and alert. Keep logs of checks, orders, validation failures and deployment results. Alert when a renewal attempt fails, when deployment does not complete, or when the live certificate approaches expiry.
The twice-daily recommendation applies to checking renewal information. It does not require, and should not cause, a replacement order on every run.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Who is responsible for renewing the certificate?
The ACME client normally performs the renewal by requesting a new certificate order. Responsibility can be split across infrastructure teams, managed services and cloud products, so document the actual owner and test the path before relying on it.
Rank #4
Customer-managed ACME certificates
For infrastructure where you control the ACME client and private key, that client must run on a dependable schedule and must be able to complete domain validation, retrieve the certificate and install it. A scheduler outage, stopped container or inaccessible validation endpoint can leave an otherwise correct policy ineffective.
AWS certificate-manager example
AWS documents a distinction that often causes confusion: ACME certificates in its certificate-management service are renewed by the ACME client, not automatically by the service. The client must request a new certificate before the existing one expires. AWS lists scheduled tasks such as cron or systemd timers as mechanisms commonly used for this automation in customer-managed environments. See AWS’s ACME issuance guidance and its ACME certificate automation documentation for the service-specific workflow.
This is different from certificates issued and managed through AWS’s own managed-renewal feature. Determine which type you are using; the presence of a certificate in the same console does not prove that the platform owns renewal for an ACME-issued certificate.
Recommended Free Tools
Polling, renewal and deployment are three different events
| Event | Purpose | Typical failure |
|---|---|---|
| Polling | Ask whether ARI or the fallback says renewal is due | Scheduler, network or client process is unavailable |
| Order and issuance | Complete validation and obtain a new certificate | DNS/HTTP validation, account, rate or CA error |
| Deployment | Install the replacement and reload the service | Wrong path, permissions, stale process or incomplete chain |
| Live verification | Confirm users receive the replacement | Load balancer, cache or one node still serves the old certificate |
Separating these events makes alerting more useful. A log entry saying that the client ran twice today proves only that polling occurred; it does not prove that issuance or deployment succeeded.
Common scheduling mistakes and fixes
Using a fixed 30-day rule everywhere
Thirty days is the one-third fallback for a current 90-day Let’s Encrypt certificate. Applying it to a certificate with another lifetime can trigger renewal too early or too late. Calculate from the certificate’s actual lifetime unless the CA supplies ARI guidance.
Confusing frequent checks with frequent orders
A twice-daily check should be idempotent: outside the renewal window it exits without ordering. Configure the client’s normal renewal logic rather than scripting an unconditional issuance request.
Assuming the platform renews ACME certificates
Verify ownership in the service documentation and in an operational test. For customer-managed ACME certificates, the client holding the private key is generally the component that must request the replacement.
Renewing successfully but serving the old certificate
Inspect the public endpoint after each deployment. If only one node or listener was updated, clients may continue to receive an older certificate even though the ACME client reports success.
Waiting for the final days
Late renewal leaves little time for repeated validation attempts, DNS propagation, access restoration or a manual recovery. ARI’s window and the lifetime-based backstop are designed to provide operational room; use that room and monitor the remaining validity.
A decision checklist for your environment
- What CA issued the certificate, and does its ACME endpoint support ARI?
- Does the selected ACME client support and enable ARI?
- How long is this certificate actually valid?
- If ARI is unavailable, is the fallback one-third remaining, or halfway for a validity period under 10 days?
- Is the recurring check running at least twice daily when following Let’s Encrypt’s recommendation?
- Which system owns the private key and places the new order?
- Where must the replacement be installed, and what reload is required?
- How will you verify the public endpoint and alert on failures before expiry?
What changed with the ARI standard?
Let’s Encrypt engineer Aaron Gable announced publication of ARI as RFC 9773 on September 16, 2025. The standard formalizes a mechanism that lets a CA communicate renewal timing instead of making operators infer a date from certificate lifetime alone. Adoption still depends on the individual CA and client, so retain the fallback and verify support in production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
