Provider guides
How 25 providers renew certificates, taken from each provider’s own documentation. 19 renew automatically, 4 only in some setups, and 2 need you (or an ACME client) every time.
Certificate resellers
GoDaddy SSLAutomatic only in some setupsGoDaddy plans are delivered as a series of shorter certificates. Whether each new certificate installs itself depends on where it's installed and which product you bought.Namecheap SSLAutomatic only in some setupsA Namecheap 1–5-year plan is a series of 200-day certificates. Automation options cover some setups; manual certificates need a reissue and reinstall every cycle.
Web hosts
BluehostRenews automaticallyBluehost's AutoSSL installs and renews free Let's Encrypt certificates for your sites.HostingerRenews automaticallyHostinger's free "Lifetime SSL" renews automatically on web, cloud and agency hosting. VPS plans don't include it.KinstaRenews automaticallyKinsta's free Cloudflare certificate renews automatically as long as one DNS record stays in place. Custom certificates are manual.SiteGroundRenews automaticallySiteGround renews Let's Encrypt certificates 30 days before expiry and its paid Premium Wildcard 15 days before. Imported certificates are manual.WP EngineRenews automaticallyCertificates WP Engine manages renew automatically. Third-party certificates you import never do.
Website platforms
HerokuRenews automaticallyHeroku's Automated Certificate Management renews one month before expiry and follows Let's Encrypt's renewal advice (ARI).NetlifyRenews automaticallyNetlify's Let's Encrypt certificates are created and renewed automatically. Custom certificates are not.ShopifyRenews automaticallyShopify issues free TLS certificates for every domain you add. You can't use your own certificate.SquarespaceRenews automaticallySquarespace provides free Let's Encrypt certificates for domains pointing at your site and refreshes them every 90 days.VercelRenews automaticallyVercel renews its Let's Encrypt certificates 14 to 30 days before expiry. Uploaded certificates are manual.WixRenews automaticallyWix generates and renews certificates for every connected domain. Changing nameservers away from Wix can stop renewals.WordPress.comRenews automaticallyWordPress.com provides free certificates for every domain hosted there and renews them while the domain stays connected.
CDNs
Cloud platforms
AWS Certificate ManagerAutomatic only in some setupsACM renews DNS-validated certificates that are in use, automatically. Imported certificates and email-validated ones need you.Azure App ServiceAutomatic only in some setupsThe free App Service managed certificate renews itself. Paid App Service certificates can auto-renew but may need domain re-verification. Uploaded certificates are manual.Google Cloud (managed certificates)Renews automaticallyGoogle-managed certificates renew automatically when about a third of their lifetime is left. Google is moving them from 90-day to 45-day validity.
Server software
CaddyRenews automaticallyCaddy renews automatically when a third of the lifetime is left, and treats that as a suggestion when the CA provides ARI.CertbotRenews automaticallyCertbot 4.0+ renews when a third of the lifetime is left, and 4.1+ follows ARI, so it adapts to 64- and 45-day certificates. Old versions and custom cron jobs are the risk.cPanel AutoSSLRenews automaticallyAutoSSL installs and renews free domain-validated certificates for every account that has the feature enabled. Purchased certificates are a separate story.nginx / Apache with a purchased certificateManual: you renew itA purchased certificate on your own nginx or Apache server is fully manual: buy or reissue, validate, install, reload. Both servers now have built-in ACME options.PleskRenews automaticallyPlesk's SSL It! extension renews free Let's Encrypt and DigiCert certificates automatically. It can't renew paid certificates.TraefikRenews automaticallyTraefik renews automatically, but its defaults assume 90-day certificates. Check the duration setting as lifetimes shrink.Windows IIS (manual)Manual: you renew itIIS doesn't fetch public certificates for you. Certificate Rebind only swaps in a certificate that something else has renewed. You need an ACME client or a manual routine.