When I renew a certificate, do I need to replace it on each vService one by one?

Short answer

No, as long as the same certificate record is updated. vServices are bound to the certificate through the record; when the content of the record changes, all the vServices that use it present the new certificate without any additional action. ACME.SH and Internal CA records are renewed automatically; Manual and PFX records are updated in place with Upload a re-signed certificate or Edit, and records generated from a CSR with Re-issue. Only if a new record is added does the certificate need to be selected again on the vServices.

Ways That Update the Record in Place

Record type	How it is renewed	Key
ACME.SH	It is checked every day at 07:00 and 22:00; a certificate that reaches the Acme.sh Automatic Renewal threshold is renewed automatically. It can also be renewed manually with Renew Certificate on the ACME.SH tab in the preview	Managed by TR7
Internal CA	Automatically at the same times, according to the renewal period in the certificate profile; manually with Renew Now (internal CA) in the right-click menu	A new key is generated
Manual / PFX	Upload a re-signed certificate in the right-click menu or in the preview: the certificate that the CA re-signed for the same key is pasted; a certificate that does not match the key is rejected	Stays the same
Manual / PFX	In the Edit form, Keep Existing Certificate and Key is turned off; a new certificate and key or a new PFX file is uploaded	Can be new
Record generated from the CSR (External CA) tab	On the request row, the re-signed certificate of the same CSR is uploaded with Re-issue: upload a newly signed certificate	Stays the same

When the record is updated, the configuration is reapplied; since the ID of the record does not change, the Certificate selection on the vServices, the HTTPS Certificate selection on the Management Access screen and the client certificate selection on the Backend Services stay as they are.

Points to Note

• Chain: Upload a re-signed certificate changes only the server certificate. If the CA has also changed the intermediate certificate, the chain is updated from the Intermediate Cert. Content field in the Edit form, or the Suggest Completion suggestion on the Chain tab in the preview is used. If the chain was built with a reference to a CA record (Use Profiles), when the CA record is updated, the chains of all the certificates bound to it are updated together (How do I add the intermediate certificate chain?).
• Adding a new record: If the renewed certificate is added as a separate record, the affected vServices are found on the Used in tab in the preview of the old record, and the new certificate is selected and saved on each of them. Used in shows only vService usage; Management Access and Backend Service usages are checked separately.
• Key pinning: If there are clients that pin the public key, the ways that keep the key (Upload a re-signed certificate, Re-issue) are used (Can I manage Private Keys separately (Private Key Library)?).
• Cluster: The record is synchronized with the LB configuration; with the default auto-sync, it is also sent to the peer device, and if Manual Sync Mode is on, it is sent manually.

Verification

• On the Details tab in the preview of the certificate, the Cert. Validity line shows the new validity dates.
• On the client side, the dates and serial number of the presented certificate are read:

openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null | openssl x509 -noout -dates -serial

Common Misconceptions

• "I need to upload the new certificate and select it on the vServices one by one." If the record is updated in place, this is not needed; the selection is changed only when a new record is added.
• "A re-signed certificate also updates the chain." Upload a re-signed certificate and Re-issue change only the server certificate; the chain is checked separately on the Chain tab.
• "Automatic renewal exists for every type." Manual and PFX records are not renewed automatically; their validity periods are monitored with a notification profile (How do I get a warning before a certificate expires?).

How it is done in the documentation

• SSL/TLS Certificates · Uploading a Re-signed Certificate
• SSL/TLS Certificates · Right-Click Menu
• SSL/TLS Certificates · Operating Mechanism
• SSL/TLS Certificates · Used in Tab

Related questions

• Can I get certificates automatically with Let's Encrypt / ACME?
• How do I get a warning before a certificate expires?
• Can I create a CSR on TR7?