ARI gives your ACME client a renewal window, not a deployment receipt

A certificate renewal job often starts from a local timer. ACME Renewal Information, or ARI, adds a way for the CA to suggest when a certificate should be renewed. The useful operational question is what your system does with that suggestion and what evidence it records afterward.

Operational design; no ARI renewal has been executed for this article.

Treat the window as scheduling input

RFC 9773 defines ARI so an ACME server can communicate a suggested renewal window. A client can use that information when choosing when to renew. This allows the CA and client to coordinate beyond a fixed local fraction of certificate lifetime.

First verify that the CA and the installed client version support the extension. A documentation page about ARI does not establish that a particular scheduled job is using it.

Observe the client’s actual behavior

Record which certificate was considered, when renewal information was checked, the suggested window and the chosen action. Include failures to retrieve information and the fallback behavior.

Avoid creating a dashboard that reports missing renewal information as a successful “no action needed” result. Unknown and failed retrievals deserve their own states.

Keep issuance and deployment separate

After a renewal order succeeds, the certificate still needs to reach every relevant TLS terminator. The server may need a reload, and the external connection needs a readback check. ARI does not perform those application-specific steps for you.

A renewal receipt should therefore include certificate retrieval, deployment targets, reload outcome and the certificate actually observed on a fresh connection.

Design a small failure exercise

In a test environment, ask what happens when the client is offline during part of the suggested window, when retrieval fails, and when issuance succeeds but deployment fails. Use the client’s official testing mechanisms and avoid repeated production orders.

This article proposes the observation fields, not a measured ARI success rate. The improvement is knowing whether the scheduling signal became a working deployed certificate.

Primary sources

• RFC 9773: ACME Renewal Information
• RFC 8555: ACME

Further reading on PKI Channel

The following Japanese-language guides add diagrams and operational detail to the questions discussed above.

• ACME ARI：更新推奨期間・再試行・配信確認 (Japanese)
• ACME更新運用：発行・配置・reload・配信確認 (Japanese)

AI was used for research assistance, writing and illustration. Examples and checklists are explanatory, not reported lab results.