Automate Your SSL Renewals

Automate Your SSL Renewals

5/27/20253 min read

black and white robot illustration
black and white robot illustration

🚀 Why You Should Automate Your SSL Renewals

Traditionally, SSL renewal meant:

  • Reissuing your CSR (Certificate Signing Request)

  • Revalidating your domain or organization

  • Manually installing the new certificate before expiration

Automation eliminates all of that.
With GlobalSign + ACME:

  • Certificates renew automatically before expiry

  • You maintain end-to-end encryption with zero manual effort

  • You can even protect internal or private domains (like .lan or .corp) — a brand-new 2025 feature.

🧠 Step-by-Step: Set Up Automatic SSL Renewal in GlobalSign

Step 1: Get Access to GlobalSign Atlas ACME

GlobalSign’s ACME service (part of their Atlas Cloud PKI) allows automation similar to Let’s Encrypt, but with enterprise-grade validation (OV/EV) and GlobalSign’s reputation.

👉 Contact GlobalSign support or your account rep to enable ACME API in your Atlas dashboard.

Once enabled, you’ll receive:

  • An ACME directory URL

  • An Account Key (Private Key) for authentication

Step 2: Configure Your ACME Client

The most common client is Certbot, but GlobalSign also supports:

  • Smallstep, lego, acme.sh, or any RFC 8555-compliant client.

For Certbot, you can run:

sudo apt install certbot certbot register --server https://acme.globalsign.com/v2/atlas --email you@domain.com

Then request your certificate:

certbot certonly --server https://acme.globalsign.com/v2/atlas --manual --preferred-challenges dns -d *.yourdomain.com -d yourdomain.com

Pro Tip:
Use DNS validation for wildcard SSL (e.g. *.domain.com) — HTTP validation won’t work for wildcards.

Step 3: Enable Auto-Renewal (Hidden Trick)

Certbot automatically installs a cron job that runs every 12 hours:

/etc/cron.d/certbot

But most admins forget to verify it’s actually running.

Run this command to test renewal manually:

sudo certbot renew --dry-run

If successful, your SSL will renew automatically in the future — even if you forget it exists.

💡 Hidden Trick #1:
GlobalSign certificates can be renewed up to 30 days before expiration.
Set your cron job to attempt renewal every 6 hours instead of 12 for maximum reliability:

0 */6 * * * certbot renew --quiet

Step 4: Automate Installation (The “Ghost Renewal” Method)

If you’re using NGINX or Apache, automate the replacement of the old certificate with this script:

#!/bin/bash systemctl reload nginx

Then link it to Certbot’s --deploy-hook:

certbot renew --deploy-hook "/path/to/reload_nginx.sh"

💡 Hidden Trick #2:
Use --deploy-hook instead of manual restarts — it prevents downtime and ensures your server reloads only when a new certificate is actually issued.

Step 5: Monitor Expiration the Smart Way

Even automation needs monitoring.
GlobalSign sends renewal notifications, but you can double-check with:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | openssl x509 -noout -dates

💡 Hidden Trick #3:
Combine this with a shell script that alerts you via Telegram or Slack when your certificate has fewer than 10 days left.

🌍 New 2025 Feature: ACME for Internal Domains

GlobalSign now allows ACME automation for non-public domains (like .lan, .local, .corp, etc.).
This is a game-changer for corporate networks that couldn’t automate SSL before.
Just enable the “Internal Domain Validation” feature in Atlas, and use the same ACME process.

✅ Pros and Cons of GlobalSign Automatic SSL

ProsCons✅ Enterprise-grade security and brand trust❌ ACME setup requires Atlas account✅ Supports OV & EV automation (rare among providers)❌ Renewal may fail if domain validation method changes✅ Works for public and private domains❌ Slightly higher cost than free CAs✅ No downtime — automatic renew + deploy❌ Must manage API keys securely✅ Multi-domain and wildcard support❌ DNS automation setup can be tricky

🧩 Final Tip: Mix Automation + Manual Backup

Even with automation, it’s smart to export your private key and certificate once a month as a backup.
Use:

tar -czvf ssl_backup_$(date +%F).tar.gz /etc/letsencrypt/live/

Store it securely — you’ll thank yourself later if your server crashes.

🔒 Conclusion

With GlobalSign’s ACME automation, SSL management moves from a chore to a self-healing system.
Whether you run one site or hundreds, automating renewals keeps you secure, compliant, and stress-free.

If you want a truly hands-off SSL strategy, GlobalSign’s new Atlas + ACME combo is one of the best tools available in 2025.