After renewing an SSL certificate, is verification still required?

　　After renewing an SSL certificate, is verification still required? This is a frequently asked question, and the answer is clear—in most cases, yes. However, the strictness and specific methods of verification depend on the type of certificate you are renewing.

　　Many people think that renewal is simply paying to extend the validity period, without changing the server configuration, and that the browser will automatically recognize it. This is incorrect. Strictly speaking, "renewing" an SSL certificate doesn't extend the old certificate; it involves applying for a new certificate to replace the expiring one. Since it's a new certificate, the CA (Certificate Authority) must confirm that you still have control of the domain. For OV and EV certificates, they also need to confirm that your business identity hasn't changed. Therefore, verification is almost unavoidable after renewal.

　　Ⅰ. understand: Renewal is not "extension," but "re-signing"

　　Before discussing verification, we need to thoroughly understand the concept of "renewal." Many people think that renewal is like renewing a mobile phone plan, simply extending the validity period of the original service. But SSL certificates don't work that way.

　　According to DigiCert's official documentation, industry standards require Certificate Authorities (CAs) to hard-code the expiration date into the certificate. Once a certificate expires, it becomes completely invalid and cannot be modified or extended. Therefore, "renewal" technically equates to purchasing, verifying, and issuing a completely new certificate for your domain.

　　Tencent Cloud's documentation also clearly states that renewal is equivalent to applying for a new certificate in the console, not adding an expiration date to the original certificate. After certificate renewal, you need to download the new certificate and reinstall and deploy it on the server. This is similar to having an expired ID card; you need to go to the police station to have your photo taken, verified, and a new one issued, rather than changing the date on the old one and continuing to use it.

　　II. Verification Methods During Renewal: Different Certificates, Different Requirements

　　Since renewal is equivalent to re-signing, the CA needs to verify that your identity and ownership have not changed. However, the verification process for renewal varies significantly depending on the certificate's verification level.

　　1. DV Certificate: Verifies Domain Name, But Can Be "Seamless"

　　DV (Domain Validation) certificates only verify your control over the domain name, not your business identity. Therefore, renewing a DV certificate essentially means re-proving your ownership of the domain.

　　This verification process can be fully automated, achieved through the ACME protocol (tools such as Certbot and Acme.sh). These tools automatically initiate renewal before the certificate expires and complete domain verification via HTTP or DNS, requiring no manual intervention.

　　However, a crucial detail needs attention: domain verification itself has an expiration date. The baseline requirement of the CA/Browser Forum (the body that sets industry rules) stipulates that a successful DCV verification record is valid for 398 days. If you renew well in advance or purchase a multi-year certificate package, the previous verification may have expired, requiring a new DCV verification process upon renewal.

　　2. OV and EV Certificates: Stricter Verification, Requires Reconfirmation of Company Identity

　　OV (Organization Validated) and EV (Extended Validated) certificates require an additional layer of company identity verification compared to DV certificates. Therefore, renewal requires not only re-verification of the domain name but also confirmation of any changes to your company information.

　　OV Certificate Renewal: Requires re-verification of company identity, typically involving a phone call to confirm the applicant's identity.

　　EV Certificate Renewal: Requires stricter requirements, including a newly completed authorization form, and the CA will call the authorized signatory to confirm the new certificate application.

　　"Identity is static, but information about individuals and organizations changes over time," so CAs must periodically re-verify this information during renewal. If your company address, phone number, or name has changed, you may need to provide new supporting documents when renewing an OV/EV certificate.

　　3. Multi-Year Certificate Orders: Verification Required Every Year Upon Renewal

　　Many CAs offer multi-year certificate packages, allowing you to purchase 1, 2, or even 3 years of service at once. However, this does not mean that a single verification is valid for many years.

　　The actual issuance rule is: the maximum validity period of a certificate is no more than 397 days (approximately 13 months). Therefore, if you purchase a multi-year service, the CA will reissue a new certificate before it expires. Each time a certificate is issued, the CA needs to check if your previous verification information is still valid.

　　For multi-year orders, different verification statuses will result in different processing times. If a verified domain name and organization identity are used during the application, the CA system may automatically reuse the stored verification information, and the OV certificate can be issued immediately. However, if the stored verification information has expired, the entire verification process needs to be repeated.

　　III. The Standard Manual Renewal Process (Taking OV/EV as an Example)

　　If you are not using automated tools like ACME and are renewing an OV or EV certificate manually, the standard process is as follows:

　　Generate a CSR and submit a renewal application: Log in to your CA account, find the corresponding certificate order, and click "Renew". The system will guide you to fill in the CSR information.

　　Re-verification:

　　Domain Verification: Follow the instructions to re-verify domain control by adding a TXT record in DNS or uploading a specified file to the website's root directory.

　　Organization Verification: For OV certificates, wait for a verification call from the CA; for EV certificates, you need to submit an updated authorization form and complete a more rigorous identity verification process.

　　Download and Install the New Certificate: After successful verification, the CA will issue a new certificate. You need to download the new certificate, replace the old certificate file on the server, and then restart the web service.

　　Summary: Whether SSL certificate renewal requires verification cannot be answered definitively. It is clear that renewing a publicly trusted SSL certificate essentially involves applying for a new certificate. Therefore, domain control must be re-verified. Furthermore, domain verification records have an expiration date (the latest requirement is 200 days). If renewal is initiated after the previous verification window has expired, the verification process must start from scratch, and old records cannot be reused.