A fixed “renew 30 days before expiry” rule works well for standard certificates but can misfire for short-lived certs, or miss CA-specific operational windows around infrastructure maintenance. ARI (ACME Renewal Information, RFC 9773) solves this by letting the CA publish a recommended renewal window per certificate. TigerTrust fetches and caches that window and uses it as the primary trigger when it is available.
Renewal Info ARI

​
What it is

When a CA supports ARI, it publishes start and end timestamps indicating when it would like you to renew a specific certificate. TigerTrust retrieves that window and stores it per certificate. The renewal scheduler checks the cache first — if a CA-recommended window exists and you are inside it, renewal fires. If no ARI data is available, the scheduler falls back to your configured fixed-day threshold. You can also manually refresh the ARI window at any time from the certificate detail page.

​
When to use it

  • Use CAs that support ARI (such as Google Trust Services or Let’s Encrypt with ARI) to get optimal renewal timing without manual configuration.
  • Refresh the ARI window after a CA announces a planned revocation event so TigerTrust renews affected certificates within the CA’s preferred window.
  • Confirm the current ARI window for a certificate before a planned maintenance blackout to ensure renewal will not fire at an inconvenient time.
  • Pair ARI with short-lived certificates to let the CA dictate the sub-24-hour renewal window rather than calculating it from a fraction of lifetime.

​
Set it up

1

Ensure the CA is ARI-capable

Confirm your CA integration supports RFC 9773. Google Trust Services and Let’s Encrypt both expose ARI. The CA detail page shows whether ARI is available.
2

View the ARI window on a certificate

Open any certificate issued by an ARI-capable CA. On the Renewal tab you will see the CA-recommended renewal window badge showing the start and end timestamps.
3

Refresh the ARI window manually

Click Refresh ARI on the certificate detail page to fetch the latest recommendation from the CA. This is useful after a CA revocation event or when you suspect the cached window is stale.

​
What you’ll see

On the certificate detail page, the Renewal tab shows either:
  • A green ARI badge with the window start and end, and the date TigerTrust last fetched it, or
  • No badge, indicating the CA did not publish ARI for this certificate or the window has not yet been fetched.
The renewal queue in Certificates > Renewal shows a Source column indicating whether the next scheduled renewal will use the ARI window, the lifetime-fraction rule (for short-lived certs), or the fixed-day threshold.

​
Tips

  • ARI takes precedence over all other renewal timing sources. If the CA sets a narrow window, TigerTrust will honor it even if it is outside your workspace’s configured renewal threshold.
  • You can query ARI data and trigger refreshes via the API. Full spec at API Reference.

Short-Lived Certificates

How ARI interacts with the lifetime-fraction rule for short-validity certs.

Certificate Renewal

The full renewal workflow and automation policy.

ACME

ACME protocol integration and challenge handling.