Renewals
Automatic scheduling plus a forced renewal endpoint for tests and operations.
Schedule
next_renewal_at is set to not_after minus renew_before_days (default 30). The hourly scheduler marks due certificates and the renewal job re-issues them.
Forced renewal
POST /api/v1/certificates/{id}/renew creates a new order for the same identifiers. Failures store error_code and emit certificate.renewal_failed.