ACME Renewal Information (ARI) in Atlas 

What is ARI? 

ACME Renewal Information (ARI) is an ACME protocol extension, defined in RFC 9773, that lets a certificate authority (CA) tell ACME clients when to renew a certificate, rather than leaving clients to decide from the expiry date alone. 

Before ARI, ACME clients typically choose a renewal time by running on a fixed schedule, renewing a set number of days before expiry, or renewing once some percentage of the validity period had passed. These approaches work, but they can't respond to anything the CA knows that the client doesn't; for example, an upcoming mass revocation or a need to spread renewal load to avoid a spike. 

ARI addresses this by letting the CA advertise a suggested renewal window for each certificate, which ARI-aware clients can use instead of, or alongside, their own expiry-based logic. 

Atlas' approach to ARI 

Atlas fully implements ARI as specified in RFC 9773. 

Automatic enablement 

Atlas advertises ARI support in its ACME directory. Any ARI-aware client calling GET /directory will see a renewalInfo field pointing to Atlas' renewal-info resource. No client-side configuration is needed; if your client supports ARI, it will pick this up automatically. 

How renewal windows are calculated 

Clients can query GET /renewal-info/{certID} for a given certificate to get back a suggestedWindow, with start and end timestamps. Atlas calculates this window differently depending on the certificate's status:

Normal certificates  

The window is calculated relative to the certificate's expiry date: 

• Start: 7 days before expiry 

• End: 5 days before expiry 

Certificates scheduled for revocation  

Atlas anchors the window to the scheduled revocation date instead, using the same 7/5-day offsets. This prompts renewal ahead of the revocation rather than the certificate's original expiry. If the certificate's natural expiry date falls before the scheduled revocation date, Atlas falls back to the standard expiry-based window. The earlier of the two dates is always chosen. 

Already expired or revoked certificates  

If a certificate is already expired or revoked, the suggestedWindow returned has both start and end in the past. This is intentional: per the RFC, a past-dated window signals that renewal is immediately due. 

Linking renewals to the certificate they replace 

Atlas also supports the replaces field from RFC 9773 on POST /new-order, letting a client declare that a new order renews a specific existing certificate. Atlas validates that the referenced certificate exists, belongs to the same ACME account, and shares at least one identifier with the new order, then returns that value on the order, get-order, and finalize responses. This gives you a verifiable, auditable link between a certificate and its renewal.