SSL certificate automation is the hands-off way to keep your website’s certificate valid: software requests it, completes validation, installs it and renews it for you before every expiry date. Set it up once, and renewals happen without you for as long as your subscription runs.
Automated RapidSSL, GeoTrust and Sectigo certificates from SSL Dragon start at $23/yr, with AutoInstall SSL®, our installation agent, or your own ACME client. Automation matters more every year: since 15 March 2026, public SSL certificates can last no more than 200 days, and the limit drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029.
Automated SSL Certificates: Compare Plans
We offer six automated SSL certificates in two groups: four RapidSSL and GeoTrust plans that work with both AutoInstall SSL® and ACME, and two Sectigo and DigiCert certificates for your own ACME client.
Plans That Support Both Automation Methods
Use whichever method suits your server. Each plan is an annual subscription with free, unlimited reissues, so shorter certificate lifetimes mean more automatic reissues, not more purchases.
RapidSSL + Automate
- AutoInstall SSL® included
- ACME compatible
- One Domain
- Domain Validation
- Issued in 5 minutes
$10,000 warranty
$23 /yr
GeoTrust QuickSSL Premium + Automate
- AutoInstall SSL® included
- ACME compatible
- One Domain
- Domain Validation
- Issued in 5 minutes
$500,000 warranty
$87 /yr
RapidSSL Wildcard + Automate
- AutoInstall SSL® included
- ACME compatible
- One Domain & All Subdomains
- Domain Validation
- Issued in 5 minutes
$10,000 warranty
$159 /yr
GeoTrust QuickSSL Premium Wildcard + Automate
- AutoInstall SSL® included
- ACME compatible
- One Domain & All Subdomains
- Domain Validation
- Issued in 5 minutes
$500,000 warranty
$285 /yr
Certificates for Your Own Automation Client
These certificates work with ACME only, so you’ll connect them to an ACME client such as Certbot, acme.sh or win-acme.
Sectigo ACME CaaS
- Best for: many sites under one ACME client
- Single domains ($25/yr) or wildcards ($159/yr)
- Domain validation (DV)
- Unlimited reissues
- Works with: ACME
- $500,000+ warranty
DigiCert Automated SSL
- Best for: OV or EV validation
- DV, OV or EV validation
- 10+ domains
- Works with: ACME
- $1,000,000+ warranty
Which SSL Automation Method Fits Your Server?
There are four ways to automate SSL certificates: AutoInstall SSL® for your own Apache, NGINX or IIS server; ACME for any environment with an ACME client; a certificate lifecycle management platform for large fleets; and your host’s built-in SSL on shared hosting. The right SSL certificate automation tool depends on where your site runs and how much access you have to the server. Find your setup in the table below.
| Your setup | Best option | What you install | Effort | Renewals and alerts | Next step |
|---|---|---|---|---|---|
| VPS, cloud or dedicated server running Apache or NGINX (Linux) or IIS (Windows), with root or admin access | AutoInstall SSL® | One agent, installed with a command you copy and paste | Lowest | Renews 28 days before expiry, checks your certificate daily and emails you if something fails | Any RapidSSL or GeoTrust plan. How AutoInstall SSL® works |
| Any environment with an ACME client: Certbot, acme.sh, win-acme, Kubernetes cert-manager, firewalls, NAS devices | ACME | Your preferred client, linked to your account with EAB credentials (a key you paste in once) | Medium | Depends on the client. If your certificate authority offers ARI renewal timing, pick a client that supports it. | Any certificate on this page. ACME SSL certificates |
| Hundreds of certificates across teams, clouds and CAs, where you need discovery and policy control | Certificate lifecycle management platform | DigiCert Trust Lifecycle Manager | High (enterprise) | Central dashboard, discovery and policy | DigiCert Trust Lifecycle Manager |
| Shared hosting (cPanel, Plesk) without root access, or a website builder | Your host’s built-in SSL, or a manual install | Nothing. AutoInstall SSL® needs server access. | – | Handled by your host, or done by hand | Manual installation guides |
On shared hosting? Most shared hosts include a free certificate. On cPanel it’s called AutoSSL, which is a different thing from AutoInstall SSL®. You can still install a paid certificate on shared hosting, but you’ll renew and reinstall it by hand: at least 4 times a year from 2027, and 8 or more by 2029. If your host gives you SSH access, an ACME client such as acme.sh may work; see our cPanel ACME guide and check with your host first. Website builders such as Wix, Shopify and Squarespace generally use only their own certificates.
Not sure which method fits? Contact our 24/7 support with your server type and we’ll point you to the right one.
Why SSL Automation Is Now Essential
In April 2025, the CA/Browser Forum adopted Ballot SC-081v3, which cuts the maximum lifetime of public SSL/TLS certificates in three steps. Apple, Google, Microsoft and Mozilla all voted for it. The first step has been in force since 15 March 2026, and each step after it makes SSL certificate automation harder to do without.
The SSL validity timeline (2026–2029)
| Issued | CA/B Forum maximum | What DigiCert brands issue | Domain validation reuse (max) | Automatic renewals per certificate per year² |
|---|---|---|---|---|
| Until 15 March 2026 | 398 days | 397 days (199 days from 24 February 2026) | 398 days | ~1 |
| 15 March 2026 (now) | 200 days | 199 days | 200 days | ~2 |
| 15 March 2027 (next) | 100 days | 99 days (planned) | 100 days | ~5 |
| 15 March 2029 | 47 days | 46 days (planned) | 10 days | ~20 |
At AutoInstall SSL®’s current 28-day renewal window. ACME clients that support ARI renew when the CA suggests, so the exact number varies.
How often does an SSL certificate need renewing?
Under Ballot SC-081v3, at least twice a year now (200-day maximum since 15 March 2026), 4 times a year from 15 March 2027 (100 days) and 8 times a year from 15 March 2029 (47 days). Automated renewal runs a little more often, because it starts early: about 2, 5 and 20 times a year at today’s 28-day renewal window.
Renewal volume adds up fast. At today’s 28-day window, 50 certificates on 47-day lifetimes mean roughly 1,000 renewals a year, which isn’t realistic to track by hand.
A missed SSL renewal is also very visible. Browsers show a full-page security warning, visitors leave, and online checkouts stop working until the certificate is replaced.
Domain validation reuse is shrinking too. From 15 March 2029, a successful domain check can be reused for only 10 days, so almost every renewal needs a fresh validation. Automation handles that step for you as well.
199 or 200 days?
Both 199 and 200 days are correct. The CA/B Forum’s rules say a certificate must not exceed 200 days and should not exceed 199. DigiCert, the CA behind RapidSSL and GeoTrust, issues 199-day certificates to stay inside the limit.
How Automated SSL Certificate Management Works
Once it’s set up, automated SSL certificate management repeats the same cycle for every certificate:
Creates a private key and a certificate signing request (CSR) on your server.
Places the validation file or DNS record.
Waits while the certificate authority checks it and issues the certificate.
Downloads and installs the certificate.
Reloads the web server and verifies the installation.
Checks the certificate every day for expiry or revocation.
Renews and reinstalls it before it expires.
You set this up once per server. Your private key stays on your own server, and while your subscription is active, every later reissue, including the extra ones that shorter lifetimes bring, runs through the same cycle automatically. This is automated SSL certificate renewal in practice: no reminders, no copying files.
Renewal isn’t the same as deployment
A renewed certificate only protects your visitors once it’s installed and the server has reloaded. Good SSL certificate renewal automation covers all three steps: renewal, installation and reload. AutoInstall SSL® does all of them. With ACME it depends on the client: Certbot’s Apache and NGINX plugins handle installation, while other clients may need a deploy hook.
Hands-Off Automation for Apache, NGINX and IIS
AutoInstall SSL® is DigiCert’s automation agent for web servers. It’s the easiest option if you run your own server and don’t want to configure anything after setup.
- Supported servers: IIS on Windows Server 2016, 2019, 2022 and 2025; Apache and NGINX on Ubuntu, Debian, CentOS and other major Linux distributions.
- What you need: root or admin access to the server.
- Validation: by file or DNS.
- Renewals: 28 days before expiry, with a daily check and an email alert if anything fails.
It works with every RapidSSL and GeoTrust plan above. It doesn’t work on shared hosting, on website builders such as Wix or Squarespace, or on managed cPanel or Plesk accounts without root access, because the agent needs to install software on the server itself.
Bring Your Own Client: Certbot, Caddy, cert-manager and More
ACME, the Automatic Certificate Management Environment, is a widely used open standard for certificate automation, defined in RFC 8555 (2019). Every certificate on this page supports it: the four RapidSSL and GeoTrust plans, Sectigo ACME CaaS and DigiCert ACME. With a paid certificate that supports ACME, you get unique automation credentials after purchase. Your client connects to your account through External Account Binding (EAB): a key ID and a secret key (an HMAC key) that you enter once. After that, the client requests certificates, completes validation and renews them on its own, and your private key never leaves your server.
ACME works with Certbot, acme.sh, win-acme, cert-manager and Caddy, plus many firewalls and NAS devices. Newer clients also support ACME Renewal Information (ARI, RFC 9773), which lets a certificate authority that offers it tell your client when to renew.
Setting up a client for the first time? We maintain 13 step-by-step ACME client guides, from Apache and NGINX to Kubernetes, mail servers and Remote Desktop, including win-acme for IIS, FortiGate, pfSense and Synology NAS.
Managing Hundreds of Certificates?
Per-server automation works well for a handful of sites. Large organizations also need to find every certificate they own, enforce policy and work across several certificate authorities. That calls for automated certificate management at scale: a certificate automation platform rather than an agent on each server. DigiCert Trust Lifecycle Manager adds discovery, central policy and multi-CA control on top of automated renewal.
Free vs Paid Automated SSL Certificates
Let’s Encrypt is free and fully automatable. Once renewal is automated, a short lifetime isn’t a problem in itself. The real differences are validation types, warranty, support and alerting.
| Let’s Encrypt (default profile) | SSL Dragon automated certificates | |
|---|---|---|
| Price | Free | From $23/yr (annual subscription) |
| Validation | DV only | DV; OV and EV via DigiCert ACME |
| Warranty | None | $10,000 to $1,000,000+, depending on product |
| Support | Community forum | 24/7 support |
| Lifetime now | 90 days | 199 days (DigiCert brands: RapidSSL, GeoTrust) |
| 2027 | 64 days, from 10 February 2027 | 99 days, from 15 March 2027 (DigiCert, planned) |
| 2028–2029 | 45 days, from 16 February 2028 | 46 days, from 15 March 2029 (DigiCert, planned) |
| How long a domain check counts | 30 days, then 10 days (February 2027), then 7 hours (February 2028) | Up to 200, then 100, then 10 days |
| Automatic installation | Certbot plugins for Apache and NGINX; other clients vary | AutoInstall SSL® (Apache, NGINX, IIS) or any ACME client |
| Expiry or failure alerts | Expiry emails ended 4 June 2025; use a separate monitor | AutoInstall SSL® emails you; with ACME, depends on the client |
Lifetime rows show what DigiCert issues; the domain-check row shows the CA/B Forum maximum, and a CA may use shorter periods.
Both options encrypt traffic in exactly the same way, so the choice comes down to what surrounds the certificate. DV certificates only prove control of the domain. OV and EV certificates also verify the organization behind the site, which some businesses, partners and procurement teams require.
If your site only needs basic encryption and you’re comfortable running Certbot, Let’s Encrypt is a good choice. If you want a warranty, OV or EV validation, failure alerts or 24/7 support, choose a paid automated certificate. For a closer look, read Let’s Encrypt vs SSL Dragon.
SSL Automation FAQ
Can SSL certificates renew automatically?
Yes. SSL certificate auto-renewal works when three things are in place:
- a certificate plan that allows automation, such as any certificate on this page
- an automation method, either the AutoInstall SSL® agent or an ACME client
- access to your server, or a platform that supports ACME
With those in place, DV renewals need no action from you while your subscription is active. OV and EV certificates also need the company’s details re-checked once a year.
Copy Link
How do I automate SSL certificate renewal?
To automate SSL certificate renewal:
- Buy any certificate listed on this page.
- Install the AutoInstall SSL® agent, or connect your ACME client using the EAB credentials from your account.
- Confirm the first certificate installs correctly, then run a test renewal if your client offers one (for example,
certbot renew --dry-run).
Our ACME client guides walk you through popular setups step by step.
Copy Link
Do I pay for every renewal?
No. With a RapidSSL or GeoTrust automation plan you pay for the subscription once a year, and every reissue during that year is free and unlimited, however often your certificate’s lifetime requires one. Your automation handles those reissues in the background.
Copy Link
Can I automate a wildcard certificate?
Yes, wildcard certificates can be automated. Choose RapidSSL Wildcard + Automate, GeoTrust QuickSSL Premium Wildcard + Automate, or add wildcard domains to Sectigo ACME CaaS. Automated wildcard certificates need DNS validation. For AutoInstall SSL®, that means a supported DNS provider with API access. For ACME, you need a client with a DNS plugin for your provider.
Copy Link
What happens if an automatic renewal fails?
If an automatic renewal fails with AutoInstall SSL®, the agent spots it during its daily check and emails you, so you can fix the issue before the certificate expires. ACME clients vary, so add expiry monitoring if yours doesn’t send alerts. Let’s Encrypt, for example, stopped sending expiry emails in June 2025. Our ACME troubleshooting guide covers the most common errors.
Copy Link
Put Your SSL on Autopilot
Pick a plan, connect your server once, and let SSL certificate automation renew your certificates for as long as your subscription runs, however short lifetimes get.