Most certificate renewals should be invisible. The ones that aren't (a firewall that needs a new certificate uploaded, a VPN that drops users for a minute, a domain the client pays for themselves) go better when the client hears about them a week ahead, in plain words.
These templates are written for MSPs and in-house IT. Replace the parts in brackets; keep them short.
When to send which
| Situation | Send | When |
|---|---|---|
| Renewal you'll do, no visible impact | Nothing, or a line in the monthly report | — |
| Renewal with a short interruption | Template 1 | 5–7 days before |
| You need something from the client (approval, payment, access) | Template 2 | As soon as you know, then again at 7 days |
| Domain the client pays for is expiring | Template 3 | 30 days before, again at 7 |
| After any of the above | Template 4 | Same day |
Lifetimes are getting shorter (100 days from March 2027, 47 days from 2029), so renewals that need an email today will need one every few weeks soon. Each template you send for a manual renewal is a reason to automate that host: see 47-day SSL certificates.
Template 1: renewal with a short interruption
Subject: [Client]: VPN certificate renewal on Tuesday 4 Nov, 7:00
Hi [Name],
The security certificate on your VPN (vpn.example.com) expires on
[date]. We'll replace it on Tuesday 4 November at 7:00, before most of
your team starts.
What to expect: anyone connected to the VPN at that time will be
disconnected for about a minute and can reconnect straight away. No
action is needed from anyone.
If that time doesn't suit, reply and we'll move it.
[Name], [MSP]
Template 2: you need something from the client
Subject: Action needed by [date]: certificate for portal.example.com
Hi [Name],
The certificate that secures portal.example.com expires on [date]. After
that, visitors will see a security warning and won't be able to use the
portal.
To renew it we need [approval of the cost of $X / the domain validation
email at [email protected] approved / admin access to the hosting
panel]. Could you [action] by [date, at least 3 working days before
expiry]?
Once that's done we'll handle the rest and confirm when it's finished.
[Name], [MSP]
Template 3: the client's domain is expiring
Subject: Your domain example.com expires on [date]
Hi [Name],
Your domain example.com is registered at [registrar] in your company's
name and expires on [date]. It isn't set to renew automatically.
If it expires, your website and email stop working, and after the grace
period someone else can register it.
Please renew it at [registrar] (or reply and we'll walk you through it),
and consider turning on auto-renew with a card that won't expire before
the renewal date.
[Name], [MSP]
For what happens after expiry, see domain expired.
Template 4: done
Subject: Done: VPN certificate renewed
Hi [Name],
The certificate on vpn.example.com was replaced this morning and is valid
until [date]. Everything is working as normal.
[Name], [MSP]
Make the renewal itself safe
- Confirm the new certificate is being served after the swap, not only installed: certificate renewed but not installed.
- Keep runbooks for the appliances you renew by hand: FortiGate, SonicWall, Sophos Firewall, IIS and RDS.
- Track every client's hosts in one place: SSL certificate monitoring for MSPs.
Check a domain
The SSL expiry checker shows every hostname's certificate and expiry date for a domain, and the domain expiry checker shows when the domain itself expires and whether it's locked.