Repository navigation
How to renew SSL certificate
SSL/TLS Certificates are used to secure communication between users and applications over HTTPS. Certificates have an expiry date and must be renewed before expiration to avoid browser security warnings and service interruptions.
In a production environment, the client or security team typically provides the renewed certificate files. The OCI Administrator uploads the new certificate and associates it with the HTTPS Listener of the Load Balancer.
SSL certificates have a limited validity period.
- 90 Days (Let's Encrypt)
- 1 Year (Most Commercial Certificates)
If a certificate expires:
- Users may receive browser security warnings.
- HTTPS trust is broken.
- Application access may be impacted.
- Compliance and security requirements may be violated.
Therefore, certificate expiry monitoring and timely renewal are important operational activities.
Before certificate expiration, the client usually shares the following files:
The renewed SSL certificate issued by the Certificate Authority (CA).
Contains:
- Domain Name
- Validity Period
- Public Key
- Certificate Authority Information
Example:
www.company.com
api.company.com
The private key associated with the SSL certificate.
Purpose:
- Used during SSL/TLS handshake.
- Enables encrypted communication.
- Must be kept secure and confidential.
Certificate chain containing intermediate CA certificates.
Purpose:
- Establishes trust between the website certificate and the trusted root CA.
- Prevents certificate chain validation errors.
Certificate Chain:
Server Certificate
↓
Intermediate CA
↓
Root CA
Obtain the following files from the client or security team:
certificate.crt
private.key
ca_bundle.crt
Verify:
- Domain Name
- Expiry Date
- Certificate Details
Before making changes:
- Document current certificate details.
- Record certificate expiry date.
- Keep rollback information available.
Navigate to:
OCI Console
→ Identity & Security
→ Certificates
→ Import Certificate
Upload:
- certificate.crt
- private.key
- ca_bundle.crt
Provide a certificate name.
Example:
Production_SSL_2026
Click:
Create Certificate
Navigate to:
Networking
→ Load Balancers
→ Select Load Balancer
→ Listeners
Open the HTTPS Listener:
Protocol: HTTPS
Port: 443
Edit Listener.
Select the newly imported certificate.
Save changes.
Verify:
- Application is accessible.
- HTTPS is functioning correctly.
- No browser certificate warnings appear.
- New expiry date is visible.
Lock Icon
→ Certificate Details
→ Verify Expiry Date
curl -v https://application-urlClient Provides Renewed Certificate
↓
Certificate Validation
↓
Import Certificate into OCI
↓
Update HTTPS Listener
↓
Validate Application Access
↓
Verify New Expiry Date
↓
Close Change Request
- Renew certificates before expiration.
- Always maintain rollback information.
- Validate certificate details before deployment.
- Verify certificate chain is complete.
- Test HTTPS connectivity after implementation.
- Monitor certificate expiration dates proactively.
Answer:
Yes. I have worked on SSL certificate renewal activities for applications behind OCI Load Balancers. The client provided the renewed certificate, private key, and CA bundle. I imported the certificate into OCI, updated the HTTPS Listener configuration, and validated HTTPS connectivity after deployment.
Answer:
The client typically provides:
- certificate.crt
- private.key
- ca_bundle.crt
These files are uploaded into OCI and associated with the HTTPS Listener.
Answer:
The private key is used during the SSL/TLS handshake process and enables secure encrypted communication between the client and server.
Answer:
A CA Bundle contains intermediate certificate chain information that helps establish trust between the server certificate and the trusted root certificate authority.
Answer:
Users may receive browser security warnings, HTTPS trust may fail, and application access can be impacted. Therefore certificates should be renewed before expiration.
Answer:
Certificates can be imported through OCI Certificates Service and then associated with the HTTPS Listener configured on the OCI Load Balancer.
Answer:
Normally, SSL certificates are generated and renewed by the client's security team or the Certificate Authority (CA). My responsibility as an OCI Administrator was to import the renewed certificate into OCI, update the HTTPS Listener configuration on the Load Balancer, perform validation testing, and verify that the application was working correctly with the new certificate after deployment.