Updated on 2026-10-10 GMT+08:00

Performing a Manual Renewal

SSL certificates have a validity period. Once a certificate expires, it cannot be used. Renewals are allowed only for valid certificates. Renewing an SSL certificate is re-issuing a certificate. After the renewal is successful, you need to install and deploy the new certificate on the server to replace the old certificate that is about to expire. The new certificate does not affect the use of the existing certificate.

For issued certificates, the system automatically notifies you of the expiration by email and SMS one month, one week, three days, and one day before a certificate expires and again when the certificate actually expired. You can renew the certificate by referring to Performing a Manual Renewal or Auto-Renewal. An expired SSL certificate cannot enable HTTPS-encrypted communication. To avoid this, manually renew the certificate before it expires. For details about the renewal process, see Figure 1.

Figure 1 Manual renewal process
Click to enlarge

Manual Renewal Restrictions

The manual renewal is available only for 30 calendar days before an SSL certificate expires. The renewal of a DigiCert DV (basic) wildcard-domain certificate is available only within 15 calendar days before the certificate expires.
Only paid SSL certificates that have been purchased in Huawei Cloud SCM and are about to expire can be renewed. Uploaded certificates, free certificates, and single-domain expansion packages cannot be renewed.
The configurations of the certificate to be renewed cannot be modified. Manually renewing an SSL certificate is to purchase a new certificate with the exact same configurations as the original one. The configurations include the certificate authority, certificate type, domain type, domain quantity, and primary domain name.
The renewal certificate and the original certificate are two independent certificates. Once the renewed certificate is issued, you need to install it on the web server or deploy it on the Huawei Cloud product where the original one is deployed.
Only the last certificate in the subscription period can be manually renewed.

Rules for Supplementing the Certificate Validity Period

Assume that the maximum validity period of a certificate is 200 days. The validity period of the renewed certificate is the renewed validity period (for example, 200 days) plus the remaining validity period of the original certificate (the maximum supplemented period is 30 days). If the remaining validity period of the original certificate exceeds 30 days, manual renewal is not supported. For example, suppose we have a 200-day certificate that expires on October 1, 2026. If a new certificate is issued on September 25, 2026 after renewal, the renewed certificate will expire five days after April 12, 2027, that is, on April 17, 2027. For details about how to supplement the certificate validity period, see Table 1.

**Table 1** Examples
Manually Renewing a Certificate Whose Validity Period Is Less Than 30 Days	Purchasing a New Certificate Whose Validity Period Is Longer Than 30 Days
Old certificate validity period: 2026-3-15 00:00:00 to 2026-10-1 00:00:00 New certificate issued after renewal: 2026-9-25 00:00:00 Number of days to be supplemented: 5 days New certificate validity period: 2026-9-25 00:00:00 to 2027-4-17 00:00:00	Old certificate validity period: 2026-3-15 00:00:00 to 2026-10-1 00:00:00 New certificate issued after renewal: 2026-9-25 00:00:00 Number of days to be supplemented: 0 days New certificate validity period: 2026-9-25 00:00:00 to 2027-4-12 00:00:00 Wasted days: 30 days

For details about the differences between certificate renewal and re-purchase, see Comparison Between Certificate Renewal and Re-purchase.

Prerequisites

The paid certificate is about to expire. To check the certificate status, log in to the CCM console on the Status/Application page of SSL certificates.

Procedure

Log in to the CCM console.
In the navigation pane on the left, choose SSL Certificate Manager > SSL Certificates.
In the row containing the desired certificate, click Renew in the Operation column. Figure 2 shows an example.

Figure 2 Renewal
On the certificate renewal page, confirm the certificate information, including Domain Type, Domain Quantity, Certificate Type, Certificate Authority, Validity Period, Enterprise Project, and Quantity. In the lower right corner of the page, click Next.

If you have any questions about the pricing, click Pricing details in the lower left corner.
Confirm the order information and agree to the CCM statement by selecting I have read and agree to the Cloud Certificate & Manager Statement. Click Pay.
On the displayed page, select a payment method.

After the payment is complete, go back to the certificate list to view the purchased certificate.

In this case, the certificate is in the Pending application. To get it issued, submit a certificate application to the CA. The CA issues the certificate only after validating your renewal application.

Follow-up Operations

Submit a certificate application to the CA.
For details, see Submitting an SSL Certificate Application to the CA.

When you provide the certificate application information, ensure that the company name is the same as that of the original certificate. The company name cannot be changed when you renew an SSL certificate.
Verify the domain name ownership.
For details, see Verify the Domain Ownership.
Verify the organization (required for OV and EV certificates only).
For more details, see Verifying the Organization.
Issue the certificate.
It will take some time for the CA to review your information. The CA will issue the certificate only after they validate your information.
Install the certificate.
Install the issued certificate on your web server to replace the old certificate. The renewal certificate and the original certificate are two independent certificates. Once the renewed certificate is issued, you need to install it on the web server or deploy it on the Huawei Cloud product where the original one is deployed. If you do not install the new certificate on the web server, your server cannot use the HTTPS service after the old certificate expires.

The procedure for installing an SSL certificate varies depending on the web server. The following describes how to install an SSL certificate on mainstream web servers.
Check whether the new certificate is successfully installed.
After the new certificate is installed on the web server, check whether the certificate has been updated.
1. Visit your website using a web browser.
2. Click in the address box of the browser and see if the validity period of the certificate has been updated.
  If the validity period of the new certificate is displayed, the new certificate has taken effect.
  
  Figure 3 Validity Period

Comparison Between Certificate Renewal and Re-purchase

For renewed certificates, the system pre-fills the information and you can pay directly after confirmation. For newly purchased certificates, you need to manually enter all the required information. After the payment, you only need to verify the domain name.
When you renew a certificate, the validity period of the new certificate will be the validity period of the original certificate plus the validity period you selected (the maximum validity period is 30 days). This is a unique benefit of the new certificate. It cannot be used for newly purchased certificates.

Only paid SSL certificates that have been purchased in Huawei Cloud SCM and are about to expire can be renewed. Uploaded certificates, free certificates, and single-domain expansion packages cannot be renewed.

Validity Periods of Current and New Certificates

After a certificate is renewed, the validity periods of the current and new certificates are as follows:

Renewal with the original certificate information
If the certificate details remain unchanged, the actual validity period of the new certificate equals the remaining validity period of the original one plus the requested validity period of the new one. A maximum of 30 days can be counted towards the validity period of the new certificate. If you have not enabled auto-renewal, you are advised to apply for a certificate 30 days at the earliest before the current one expires.

This rule is formulated, interpreted, and clarified by the corresponding CA.
Renewal with changed certificate information (for example, domain name, certificate type, or company name)
The validity periods of the current and new certificates are calculated separately.

The use of the new certificate does not affect the current certificate. The current certificate can continue to be used until it expires.

FAQ

Parent topic: Renewing an SSL Certificate