SSL Renewal Workload Calculator

Estimates how many certificate renewals per year your team faces, and the manual hours and cost behind them, for any certificate lifetime from about one year down to 47 days.

Your numbers

Certificates in usecertificatesEvery public or internal certificate your team is responsible for keeping valid.Certificate lifetimePublic certificate lifetimes are being shortened in steps; choose the one your certificate authority issues.Renew when this much of the lifetime has elapsed%Many ACME clients renew with a third of the lifetime remaining, which is 67%.Share renewed automatically%Certificates handled end to end by ACME, your CDN or your load balancer with no human steps.Minutes per manual renewalminutesCSR, validation, install, service restart and verification for one certificate done by hand.Loaded hourly rate$/hourWhat an hour of the person doing renewals costs your business, including overhead. Results update as you type.

Your estimate

Total renewals per year...

Manual renewals per year...

Manual hours per year...

Manual renewal cost per year...

Estimates only. Assumptions are listed below, and you can change every input.

Certificate lifetimes are getting shorter. A fleet that needed one renewal per certificate per year becomes a weekly chore when lifetimes drop to 100 or 47 days, and anything still renewed by hand turns into a real staffing question. Teams tend to discover this only when the calendar fills up with reminders, which is the wrong moment to plan.

This calculator takes your certificate count, the lifetime your certificate authority issues, and the point in the lifetime at which you renew. It computes the renewal interval, scales it to a year, and separates automated renewals from manual ones. Multiply the manual share by your minutes per renewal and hourly rate and you get the annual hours and cost of keeping certificates valid without automation. Try the same fleet at different lifetimes to see how the workload grows.

How to use this tool

Count the certificates your team keeps valid, including internal ones, and pick the lifetime your certificate authority issues.
Set the point at which you renew, the share already automated, and how long a manual renewal takes at your loaded hourly rate.
Compare the manual hours and cost across lifetimes, then decide which certificates to automate first and how far ahead reminders need to fire.

What the math assumes

A year is counted as 365 days and every certificate is renewed at the same point in its lifetime.
The renewal interval is the lifetime multiplied by the renew-at percentage; renewing at 67% of a 90 day certificate means a renewal every 60 days.
Automated certificates are assumed to cost zero human minutes; failed automations and their cleanup are not modeled.
Minutes per renewal and the hourly rate are your own inputs; the defaults are placeholders, not industry benchmarks.
The fleet size is treated as constant for the year; certificates added or retired mid year are not counted.

Frequently asked questions

Why does the workload jump so much when the lifetime shrinks?

Renewals per year scale with the inverse of the interval. Moving from 398 days to 47 days multiplies renewals by roughly eight and a half for the same fleet, and every one of them still needs validation, install and verification if done by hand.

What should I enter for certificates behind a CDN or load balancer that renews for me?

Count them in the total and include them in the automated share. They still expire and still deserve a reminder, but they cost no manual minutes when the automation works.

Does the calculator account for wildcard or multi domain certificates?

One certificate is one renewal regardless of how many names it covers. If consolidating names into fewer certificates is an option for you, lower the certificate count to see the effect.

Is 67 percent the right renewal point for a one year certificate?

Not necessarily. For long lifetimes a fixed lead time of 30 or 60 days is more common, which is a higher percentage. Set the value that matches your reminder policy; the tool only needs the point at which the renewal happens.

Link to this toolhttps://latepinger.com/tools/ssl-renewal-workload/

Free for readers and publishers alike. If you cite the result in an article, a link to this page helps others find it.

More free tools from LatePinger

Missed Renewal Cost Calculator: Estimates what lapsed domains, certificates, licenses and contracts cost your business each year, so you can put a real number on the risk before deciding how much effort tracking deserves.
Renewal Lead Time Planner: Works out how many days before expiry your first reminder should fire, and spaces the follow-ups, based on how long approval and vendor processing really take in your company.

Never miss a renewal that matters

Expiry reminders for domains, SSL, and renewals.

Track a renewal