# Renew or revoke a certificate

> Renew an SSL/TLS certificate before it expires, or revoke one you no longer want served.

Source: https://docs.coritan.com/websites/ssl/renew-or-revoke-a-certificate/

In the dashboard:

- /dashboard/websites/…/ssl: https://www.coritan.com/dashboard/websites

Coritan renews certificates on its own once they have 30 days or less left ([How SSL/TLS certificates work](/websites/ssl/#renewal)). Renew one yourself when it is close to expiry and has not renewed, or when you want a new one early. Revoke a certificate to stop Coritan serving it.

## Before you begin

- The certificate must be `active`. The **Renewal** card, with **Renew now** and **Revoke certificate…**, appears only for an `active` certificate.
- A renewal validates the same way the certificate was first validated. For Coritan DNS the zone must still be at Coritan, and for HTTP validation the name must still resolve to the edge.

## Renew a certificate

1. In the dashboard, go to [Websites](https://www.coritan.com/dashboard/websites), open the domain and select the **SSL** tab.
2. On the **Renewal** card, select **Renew now**.

For a name without an **SSL** tab, such as `www.example.com`, go to [Edge Proxy](https://www.coritan.com/dashboard/proxies), open its web proxy and select **Renew now** on the **Certificate** card of the **Overview** tab.

## Revoke a certificate

> [!WARNING]
> Revoking removes the certificate from the name's web proxy. Visitors get a certificate error over HTTPS until a new certificate is in place.

1. In the dashboard, go to [Websites](https://www.coritan.com/dashboard/websites), open the domain and select the **SSL** tab.
2. On the **Renewal** card, open the **More certificate actions** menu and select **Revoke certificate…**.
3. Type the domain, such as `example.com`, to confirm.
4. Select **Revoke certificate**.

## Result

After **Renew now**, the dashboard confirms `Renewal of the certificate for example.com started.` Once the certificate authority issues the new certificate, the **Expires** row moves forward, **Last renewal** shows the date, and the web proxy serves the new certificate.

After you revoke a certificate, the dashboard confirms `Certificate for example.com revoked.` and the certificate shows `revoked`. Coritan stops serving it, but it does not ask the certificate authority to revoke it. To serve HTTPS again, [request a certificate from the web proxy](/websites/ssl/issue-a-certificate/#request-a-certificate-for-a-web-proxy).

## Troubleshooting

The certificate shows `failed` after a renewal
: The renewal did not validate. The previous certificate stays in use until its **Expires** date. Read the reason under **The last request failed**, fix it, and [issue a new certificate](/websites/ssl/issue-a-certificate/) before that date.

A certificate validated with a manual TXT record did not renew
: Each renewal needs a new `TXT` value, which Coritan cannot add at another DNS provider, so the renewal fails and the certificate shows `failed`. Run [the manual DNS validation](/websites/ssl/issue-a-certificate/#issue-a-certificate-with-a-txt-record-at-another-dns-provider) again before the **Expires** date. To stop this happening, move the domain's DNS to Coritan or use HTTP validation.

A certificate is close to its **Expires** date and has not renewed
: Select **Renew now**. If the renewal fails, the **Certificate** card gives the reason.

The **SSL** tab offers no way to request a certificate after you revoked one
: The tab keeps showing the `revoked` certificate. Select **Request certificate** on the web proxy's **Overview** tab in Edge Proxy, or order one with the API.

`No active certificate found for this domain`
: Only an `active` certificate can be renewed. Issue a new certificate instead.

`Renewal already in progress`
: Coritan is already renewing the certificate. Wait for the **Certificate** card to update.

## Related

- [How SSL/TLS certificates work](/websites/ssl/)
- [Issue an SSL/TLS certificate](/websites/ssl/issue-a-certificate/)

## With the API

Renew an `active` certificate by its name. The answer is `202`:

```bash
curl -X POST https://api.coritan.com/api/v1/ssl/certificates/example.com/renew \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

```json
{
  "message": "Certificate renewal queued",
  "job_id": 5814,
  "domain": "example.com"
}
```

Revoke it. The answer is `200` with `{"message": "Certificate revoked", "domain": "example.com"}`, or `404` with `No active certificate found` when the name has no `active` certificate:

```bash
curl -X DELETE https://api.coritan.com/api/v1/ssl/certificates/example.com \
  -H "Authorization: Bearer $CORITAN_TOKEN"
```

To serve HTTPS again, order a new certificate with `POST /api/v1/ssl/certificates` ([Issue an SSL/TLS certificate](/websites/ssl/issue-a-certificate/#with-the-api)).

## API

- `POST /api/v1/ssl/certificates/{domain}/renew`: Request certificate renewal for a domain (https://docs.coritan.com/api/reference/client/ssl/#op-post-api-v1-ssl-certificates-domain-renew)
- `DELETE /api/v1/ssl/certificates/{domain}`: Revoke/deactivate an SSL certificate for a domain (https://docs.coritan.com/api/reference/client/ssl/#op-delete-api-v1-ssl-certificates-domain)