--- title: "SSL Certificate Management: Renewal, Install, Monitor" date: 2026-10-29 type: post url: /cert-management canonical: https://webmaintenance.com.au/cert-management --- # SSL Certificate Management: Renewal, Install, Monitor Website cert management covers SSL/TLS certificate expiry, renewal and verification for HTTPS. For an Australian business, the key checks are which hostnames are protected, who is responsible for renewal and whether the public website presents a valid certificate. The aim is to prevent expiry warnings and avoid a mismatch between a renewed certificate and the one visitors receive. ## What is cert management for a website? Cert management for a website is the process of tracking, validating, renewing and checking the SSL/TLS certificates used for HTTPS. It includes the live certificate presented to visitors, its expiry date, covered domain names and responsibility for fixing renewal failures. For an Australian business, the practical goal is a trusted HTTPS connection on the production website and its important subdomains. Certificate management does not replace website security updates, malware protection or backups. HTTPS encryption also does not establish that a website or business is trustworthy. ### Which digital certificates are relevant to websites? Publicly trusted TLS server certificates secure HTTPS connections between browsers and websites. Their main properties include the issuing certificate authority, hostname coverage, expiry date and certificate chain. Other digital certificates protect email, internal systems or client identities. These belong to broader public key infrastructure (PKI) and are not automatically included in routine website SSL monitoring. ## How the SSL certificate lifecycle works A reliable certificate lifecycle has six operational stages. Issuing a replacement certificate is not the same as installing it successfully on the public website. 1. **Discover:** identify all production hostnames and certificate termination points. 2. **Validate:** confirm domain control and obtain the certificate from a trusted issuer. 3. **Install:** deploy the certificate and required chain on the intended endpoint. 4. **Monitor:** track the live expiry date, hostname coverage and errors. 5. **Renew:** replace the certificate before expiry and verify deployment. 6. **Revoke:** revoke compromised certificates and resolve broken trust chains where applicable. ### How to check SSL certificate details and expiry Open the website in a browser, inspect the connection or certificate information and record the expiry date, issuer and covered hostnames. Repeat the check for www, the apex domain and any public subdomains that use separate certificates. Check the certificate actually served by the website, not only the certificate shown in a hosting control panel. A CDN, reverse proxy or load balancer can present a different certificate. Record the checked hostname, inspection date, expiry date and issuer so the next check can identify changes. ## How automated certificate renewal works Automated renewal uses a certificate authority and a supported validation workflow to obtain a replacement certificate before expiry. ACME is a widely used protocol for this process. Automatic issuance still depends on domain validation, reachable challenge endpoints or correct DNS permissions. The replacement must also be deployed to every endpoint serving HTTPS. For example, a certificate issued by an ACME client on the origin server will not replace a separate certificate served by a CDN unless that CDN is configured to update it. ### What to test after an SSL certificate renews After renewal, confirm that visitors receive the new certificate and that the website remains functional. A successful renewal log proves only that a workflow ran; an external HTTPS check verifies what a customer actually receives. - **Certificate:** check the externally served serial number and expiry date. - **Coverage:** verify the apex domain, www and important subdomains. - **Configuration:** confirm hostname matching, the certificate chain and HTTPS redirects. - **Functionality:** test representative pages, forms and checkout or login paths. **Example verification record:** For `www.example.com` (illustrative hostname only), record the observed expiry date, issuer and certificate serial number before renewal. After renewal, repeat the check from an external connection and confirm that the live serial number or validity period has changed as expected. Also test the apex domain and any CDN-served hostname. This is a reproducible check, not a claim that WebMaintenance has tested a particular customer site. ## What happens when an SSL certificate expires? An expired TLS certificate normally triggers a browser security warning and prevents an ordinary trusted HTTPS connection. The server may remain online, but visitors can be blocked or discouraged from proceeding. For ecommerce and lead-generation websites, this can interrupt checkout, enquiry forms, logins and integrations that reject untrusted certificates. The impact depends on the affected hostname and client software. ## Who is responsible for SSL certificate renewal? Certificate renewal responsibility depends on who controls the domain, hosting environment, CDN and TLS termination point. A registrar, hosting provider, platform operator and maintenance agency can each manage different steps. Document one accountable owner for renewal and a separate verification owner for the live connection. SSL monitoring alone does not establish who pays for, issues or installs certificates. The responsibility depends on the hosting arrangement and the agreed service scope. | Component | Typical owner to verify | Proof to request | | --- | --- | --- | | Domain DNS | Domain account owner or DNS operator | Domain access and validation route | | Certificate issuance | Host, platform or certificate administrator | Issuer and renewal configuration | | Certificate deployment | Web server, CDN or platform operator | Live HTTPS validation | | Monitoring and incident escalation | Maintenance or operations team, if contracted | Alert recipients and response scope | ### Does hosting already include SSL management? Some hosting packages include certificate issuance and renewal, while others provide only SSL installation tools or sell certificates separately. Check your hosting agreement and the domain's TLS configuration. Ask whether automatic renewal is enabled, which domain names are covered, who responds to failures and whether CDN or external server endpoints are included. ### How WordPress and Shopify SSL responsibilities differ WordPress sites on self-managed hosting depend on the configured host, control panel or certificate automation for HTTPS. WordPress plugin updates do not automatically renew a server certificate. Shopify states that it supplies TLS certificates for domains connected to its platform. Store owners still manage correct DNS connections and investigate domain status errors. Custom infrastructure outside Shopify has a separate responsibility boundary. ## What affects SSL management costs in Australia? The cost depends on the certificate arrangement, number of domains, environment complexity, monitoring and support scope. A no-cost certificate can still require paid technical work for setup, verification or outage response. | Cost factor | What changes the workload | | --- | --- | | Certificate product | Free or paid issuance; certificate type and supplier | | Domains and endpoints | Wildcard, multiple domains, subdomains or separate infrastructure | | Renewal automation | DNS challenges, API access and integration support | | Support coverage | Expiry monitoring, installation, validation and incident response | ### What to verify in your website maintenance plan Before buying a website maintenance plan, confirm whether it includes expiry alerts only or also certificate procurement, renewal, installation, live validation and incident response. Request written responsibility for subdomains, staging, CDNs, third-party hosting and after-hours expiry incidents. Ask for a named escalation contact and a record of the latest successful renewal test. WebMaintenance publicly advertises SSL monitoring and renewals with its website care offering. The published Care Essential price is A$249 per month plus GST and Care Growth is A$399 per month plus GST. These are general website maintenance plan prices, not standalone certificate-management prices. Confirm the scope in writing for your hosting, domain and CDN setup, including whether certificate purchase, installation, failed-renewal recovery and after-hours support are covered. ## Why certificate monitoring and service scope matter Shorter certificate validity periods increase renewal frequency, reducing the time available to detect broken automation. Monitoring provides an independent signal when a certificate is near expiry or the wrong certificate is live. According to the CA/Browser Forum, *Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates*, the maximum validity periods for newly issued publicly trusted TLS server certificates are: - **From 15 March 2026:** 200 days. - **From 15 March 2027:** 100 days. - **From 15 March 2029:** 47 days. These maximums apply based on the certificate issuance date. The published schedule does not mean an existing certificate expires automatically when a new limit takes effect. Renewal automation and external monitoring become more important as validity periods shorten. ### Can an SSL certificate renew automatically without manual payment? YES, automatic renewal without a manual certificate payment is possible when the certificate authority, hosting environment and chosen renewal service support it. Free certificate issuance does not mean the website's [monitoring or technical support](https://webmaintenance.com.au/) is free. ### Does an expired SSL certificate always mean a website is offline? NO, an expired certificate does not necessarily mean the web server is offline. The server can continue responding while browsers reject or warn about its HTTPS identity, which can still disrupt visitors and affect [search visibility](https://webmaintenance.com.au/seo). ### Can SSL renewal succeed without updating the live web server? YES, renewal can finish while the live server continues to use an old certificate. A reload failure, an incorrect certificate path or an unupdated CDN endpoint can cause this mismatch. ### Is a free SSL certificate suitable for a small business website? YES, a free publicly trusted SSL/TLS certificate is suitable for many small business websites when it covers the right hostnames and has reliable renewal and deployment. Certificate price alone does not determine the security of the underlying website, which also depends on [patching server software such as PHP](https://webmaintenance.com.au/website-security/php2shell). ### Does Shopify manage its own storefront TLS certificates? YES, according to the Shopify Help Centre, Shopify provides TLS certificates for domains connected to its platform. Incorrect DNS records and domain status errors still require troubleshooting. ### Should certificate monitoring continue when auto-renew is enabled? YES, expiry monitoring remains necessary with auto-renew enabled. Independent checks detect failed validation, missed deployment and unexpected changes to the certificate presented to visitors.