Renewal
Certificates the platform issued are renewed automatically, starting 30 days beforeexpires_at. The window is deliberately wide: it leaves room for many
attempts before anything actually expires, so a transient DNS or authority
problem is not an outage.
Renewal reuses the existing challenge delegation, so a CNAME you published once
keeps working. When a certificate is reissued its fingerprint changes — that
is the signal to anything holding the material that there is a new generation to
pick up.
A renewal that fails is retried, but not immediately: a certificate whose last
attempt was under six hours ago is skipped, so a stuck CNAME or an authority
having a bad day is retried on a sensible cadence rather than on every pass.
Uploaded certificates are excluded from renewal. See
Uploading your own certificate.
Revoking
Revocation is API only. The console’s action on a certificate is
Delete certificate, which is a different thing: deleting removes the
certificate from your account, while revoking asks the issuing authority to
mark it invalid so clients that check revocation stop trusting it. If the
private key may have leaked, revoke — deleting alone leaves a certificate
that still validates.
202 with the certificate
still in its previous state, and you poll until status is revoked. An
uploaded certificate is revoked locally, without contacting an authority.
Revoking something already revoked is a no-op, not an error.