diff --git a/src/content/docs/ssl/edge-certificates/advanced-certificate-manager/manage-certificates.mdx b/src/content/docs/ssl/edge-certificates/advanced-certificate-manager/manage-certificates.mdx index 7ea0302ca6c97c5..944942365b5f2a1 100644 --- a/src/content/docs/ssl/edge-certificates/advanced-certificate-manager/manage-certificates.mdx +++ b/src/content/docs/ssl/edge-certificates/advanced-certificate-manager/manage-certificates.mdx @@ -107,3 +107,9 @@ You can configure alerts to receive notifications for changes in your certificat /> + +--- + +## Advanced certificate renewal + +The certificate validity period you choose determines when the auto renewal will start for your certificate. For details, refer to [Validity period and renewal](/ssl/reference/certificate-validity-periods/). \ No newline at end of file diff --git a/src/content/docs/ssl/edge-certificates/universal-ssl/enable-universal-ssl.mdx b/src/content/docs/ssl/edge-certificates/universal-ssl/enable-universal-ssl.mdx index 293117a6d4ec8ab..182ddd0e0f2ec5a 100644 --- a/src/content/docs/ssl/edge-certificates/universal-ssl/enable-universal-ssl.mdx +++ b/src/content/docs/ssl/edge-certificates/universal-ssl/enable-universal-ssl.mdx @@ -54,4 +54,4 @@ Once you enable Universal SSL, you can review the [activation status](/ssl/refer -If you are on a [partial setup](/ssl/edge-certificates/universal-ssl/enable-universal-ssl/#partial-dns-setup), make sure [Domain control validation (DCV)](/ssl/edge-certificates/changing-dcv-method/) is configured correctly. Refer to [Troubleshooting DCV](/ssl/edge-certificates/changing-dcv-method/troubleshooting/) for further help. \ No newline at end of file + For details, refer to [Validity periods and renewal](/ssl/reference/certificate-validity-periods/). \ No newline at end of file diff --git a/src/content/docs/ssl/reference/certificate-authorities.mdx b/src/content/docs/ssl/reference/certificate-authorities.mdx index 9aa42865ed4bc41..655259833857a7c 100644 --- a/src/content/docs/ssl/reference/certificate-authorities.mdx +++ b/src/content/docs/ssl/reference/certificate-authorities.mdx @@ -29,10 +29,10 @@ For publicly trusted certificates, Cloudflare partners with different certificat -## Features, limitations and browser compatibility +## Features, limitations, and browser compatibility :::caution[Universal SSL] - +For Universal certificates, Cloudflare controls the validity periods and certificate authorities (CAs), making sure that renewal always occur. For details, refer to [Universal SSL](/ssl/edge-certificates/universal-ssl/). ::: *** diff --git a/src/content/docs/ssl/reference/certificate-validity-periods.mdx b/src/content/docs/ssl/reference/certificate-validity-periods.mdx index 411922315ce5c2d..697d0da6b7ebb82 100644 --- a/src/content/docs/ssl/reference/certificate-validity-periods.mdx +++ b/src/content/docs/ssl/reference/certificate-validity-periods.mdx @@ -13,13 +13,21 @@ description: Review information about available validity periods for your import { Render } from "~/components" +For certificates managed by Cloudflare, attempts to renew start at the auto renewal period and continue up until 24 hours before expiration. The auto renewal period varies according to the certificate validity period, as explained in the sections below. + +If a certificate fails to renew and another valid certificate exists for the hostname, Cloudflare will deploy the valid certificate within the last 24 hours before expiration. + +:::note +For information regarding custom certificates (managed by you), consider this other page on [renewal and expiration](/ssl/edge-certificates/custom-certificates/renewing/). +::: + ## Universal SSL ## Advanced certificates -When you order an [advanced certificate](/ssl/edge-certificates/advanced-certificate-manager/manage-certificates/), you can select the following values for the **Certificate validity period**: +When you order an [advanced certificate](/ssl/edge-certificates/advanced-certificate-manager/manage-certificates/), you can select different certificate validity periods. Each certificate validity period has a corresponding auto renewal period, when [attempts to renew](/ssl/reference/certificate-validity-periods/) will start. | Certificate validity period | Auto renewal period | Notes | | --------------------------- | ------------------- | -------------------------------------------------------------------------------------- | @@ -44,12 +52,4 @@ First, shorter-lived certificates limit the damage from key compromise and mista Second, shorter certificates encourage automation. The more frequently you have to do a task, the more likely you will want to automate it. Automation also means that you are less likely to let a certificate expire in production or give a person access to key material. -For more details on the benefits of shorter validity periods, refer to our [blog post introducing Advanced Certificate Manager](https://blog.cloudflare.com/advanced-certificate-manager/). - -## Failure to renew and certificate replacement - -For certificates managed by Cloudflare, attempts to renew start at the auto renewal period (based on the [different validity periods](/ssl/reference/certificate-validity-periods/#advanced-certificates)) and continue up until 24 hours before expiration. - -If a certificate fails to renew and another valid certificate exists for the hostname, Cloudflare will deploy the valid certificate within these last 24 hours. - -For information regarding custom certificates (managed by you), consider this other page on [renewal and expiration](/ssl/edge-certificates/custom-certificates/renewing/). +For more details on the benefits of shorter validity periods, refer to our [blog post introducing Advanced Certificate Manager](https://blog.cloudflare.com/advanced-certificate-manager/). \ No newline at end of file diff --git a/src/content/partials/ssl/universal-ssl-validity.mdx b/src/content/partials/ssl/universal-ssl-validity.mdx index 6b2e03f56063a20..1e93a94e9cd8a9a 100644 --- a/src/content/partials/ssl/universal-ssl-validity.mdx +++ b/src/content/partials/ssl/universal-ssl-validity.mdx @@ -5,6 +5,10 @@ For Universal certificates, Cloudflare controls the validity periods and certificate authorities (CAs), making sure that renewal always occur. +:::note[Partial setup and DCV] +If you are on a [partial setup](/ssl/edge-certificates/universal-ssl/enable-universal-ssl/#partial-dns-setup), make sure [Domain control validation (DCV)](/ssl/edge-certificates/changing-dcv-method/) is configured correctly. Refer to [Troubleshooting DCV](/ssl/edge-certificates/changing-dcv-method/troubleshooting/) for further help. +::: + Universal certificates issued by Let's Encrypt, Google Trust Services, or SSL.com have a 90-day validity period. Cloudflare no longer uses DigiCert for newly issued Universal certificates and, for existing ones, the validity period is being adjusted from one year to 90 days. For 90-day certificates, the auto renewal period starts 30 days before expiration. \ No newline at end of file