Renewal settings

Renewal settings define the conditions under which certificates can be renewed. Use these settings to control when valid, expired, or revoked certificates are eligible for renewal and whether the existing key pair or a new key pair must be used during the renewal process.

JSON structure example

Configuration for renewing valid certificates without a renewal window and preventing renewal of expired certificates

"renewal_settings": {
  "renew_valid_cert": "anytime",
  "renew_expired_cert": "dont_allow",
  "renew_revoked_cert": true,
  "renewal_key_pair": "optional",
  "allow_override_renewal_key_pair": true
}

Configuration for allowing certificate renewal only within defined renewal windows, starting 30 days before expiration and ending 2 months after expiration

"renewal_settings": {
  "renew_valid_cert": "in_specific_window",
  "renew_before_expiration_window": {
    "period": "days",
    "duration": 30
  },
  "renew_expired_cert": "in_specific_window",
  "renew_after_expiration_window": {
    "period": "months",
    "duration": 2
  },
  "renew_revoked_cert": true,
  "renewal_key_pair": "optional",
  "allow_override_renewal_key_pair": true
}

Parameters

Table 1. Parameters: Renewal settings

Name	Type	Required/optional	Possible values
renew_valid_cert	String	Optional	Specifies when valid certificates can be renewed. Supported values include: `anytime` (default) - allows renewal of valid certificates at any time before expiration `in_specific_window` - allows renewal of valid certificates only within the period defined by `renew_before_expiration_window` `dont_allow` - does not allow renewal of valid certificates
`renew_before_expiration_window`	Object	Required (when `renew_valid_cert` is set to `in_specific_window`)	Defines the renewal window before certificate expiration
`..period`	String	Required	Specifies the duration unit. Supported values include: `minutes` `hours` `days` `months` `years`
`..duration`	Integer	Required	Specifies the duration value. Must be a positive integer
`renew_expired_cert`	String	Optional	Specifies when expired certificates can be renewed. Supported values include: `anytime` (default) - allows renewal of expired certificates at any time after expiration `in_specific_window` - allows renewal of expired certificates only within the period defined by `renew_after_expiration_window` `dont_allow` - does not allow renewal of expired certificates
`renew_after_expiration_window`	Object	Required (when `renew_expired_cert` is set to `in_specific_window`)	Defines the renewal window after certificate expiration
`..period`	String	Required	Specifies the duration unit. Supported values include: `minutes` `hours` `days` `months` `years`
`..duration`	Integer	Required	Specifies the duration value. Must be a positive integer
`renew_revoked_cert`	Boolean	Optional	Specifies whether revoked certificates can be renewed. Supported values include: `true` (default) - allows revoked certificates to be renewed `false` - prevents revoked certificates from being renewed
`renewal_key_pair`	String	Optional	Specifies whether the renewed certificate uses the existing key pair or a new key pair. Supported values include: `optional` (default) - allows the renewed certificate to use either the existing key pair or a new key pair `always` - requires a new key pair for the renewed certificate `newer` - requires the renewed certificate to use the existing key pair
`allow_override_renewal_key_pair`	Boolean	Optional	Specifies whether certificate profiles can override the value of `renewal_key_pair`. Supported values include: `true` (default) - allows certificate profiles to override the value of `renewal_key_pair` `false` - prevents certificate profiles from overriding the value of `renewal_key_pair`