Applies to: Cloud
Audience: Site Administrators
Time: Approximately 10 minutes
An SSL (Secure Sockets Layer) certificate authenticates your site's identity and enables an encrypted connection between your users and your intranet. SSL certificates have a finite lifespan and must be renewed before they expire to maintain site accessibility.
Note: If Axero manages your SSL certificate, renewals are handled automatically and no action is required on your part. This guide applies only to sites where you provide your own SSL certificate.
Renew your SSL certificate at least two weeks before it expires. An expired certificate causes browsers to display a security warning and can prevent users from accessing your site entirely.
To check your current certificate's expiration date, click the padlock icon in your browser's address bar while on your Axero site. The certificate details will display the expiration date.
Tip: Set a calendar reminder 30 days before your certificate's expiration date. This gives you time to obtain the renewed certificate from your certificate authority and submit it to Axero before the deadline.
To renew a self-managed SSL certificate on your Axero site, submit a private support case with the required files:
.pfx
Tip: If your certificate authority provides separate .crt and .key files instead of a .pfx file, you can convert them using OpenSSL:openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crtYou will be prompted to set a password for the .pfx file. If you are unfamiliar with this process, contact your certificate authority and request the certificate in .pfx format directly.
.crt
.key
openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt
intranet.yourdomain.com
*.yourdomain.com
Important: Always submit the certificate password through a private support case. Do not share certificate passwords through email or other unsecured channels.
After the Axero team installs your renewed certificate, you will receive confirmation through your support case. No site restart or downtime is required.
Tip: If your site uses a custom subdomain (e.g., intranet.yourdomain.com), you can provide a wildcard certificate (e.g., *.yourdomain.com) instead of a single-domain certificate. A wildcard certificate covers all subdomains under your main domain, which simplifies certificate management if you use multiple subdomains for different services. Specify the wildcard domain as the domain name in your support case.
Site displays a security warning or is inaccessible
Your SSL certificate may have expired. Check the expiration date by clicking the padlock icon in your browser. If the certificate has expired, submit a renewal immediately through a private support case. Contact your Technical Account Manager if urgent assistance is needed.
Certificate installation fails due to password mismatch
The password provided in your support case does not match the password set on the .pfx file. Re-export the .pfx file with a known password and resubmit it through your support case.
Certificate does not match the domain
The domain name on the certificate must exactly match your site's domain. For example, a certificate issued for www.yourdomain.com will not work for yourdomain.com. Verify the domain name with your certificate authority and reissue if necessary. A wildcard certificate (e.g., *.yourdomain.com) covers all subdomains but does not cover the root domain itself.
www.yourdomain.com
yourdomain.com
Certificate file is not in .pfx format
Axero requires certificates in .pfx (PKCS#12) format. If your certificate authority provided separate .crt and .key files, use the OpenSSL command in the renewal steps above to convert them, or request a .pfx file from your certificate authority.
If you need assistance with SSL certificate renewals or have questions about certificate requirements, submit a support case.
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/87083/ssl-certificate-renewals
Your session has expired. You are being logged out.