Domain and SSL renewal checklist for web agencies (free template)
By the RenewRoster team · · 8 min read
Most agencies have a launch checklist. Very few have a renewal checklist, even though renewals are what quietly break client sites years after launch. Here's the one we'd use if we ran an agency with anything from 10 to 500 client domains, plus a free template you can copy into Google Sheets or Excel.
Download the checklist template (CSV)
Part 1: Build the inventory (once)
You can't renew what you don't know about. Start with a complete list. For every client, record each domain and each hostname that serves an SSL certificate, because they expire separately and for different reasons.
For every domain, record
- Client and domain, including secondary domains, old brand names and country variants that redirect.
- Registrar, such as GoDaddy, Namecheap, Cloudflare or Spaceship.
- Account owner: is it in the agency's account or the client's?
- Who pays: the agency (and bills it back), or the client directly.
- Auto-renew on or off, and which card, with its expiry month.
- Expiry date, taken from the registry via RDAP rather than an old invoice.
- Renewal cost, because some TLDs and premium names renew at much higher prices.
- DNS host, since an expired DNS hosting plan can break a site just like an expired domain.
For every certificate, record
- Hostname: the apex domain, www, mail, shop, API, staging and any other subdomain clients rely on.
- Certificate authority, such as Let's Encrypt, Google Trust Services, Sectigo or DigiCert.
- Renewal method: automatic via ACME (the protocol behind Let's Encrypt), automatic via the host or CDN, or manual.
- Expiry date of the certificate the host actually serves.
- Where it's installed: hosting panel, load balancer, CDN or mail server.
Tip: don't type expiry dates by hand. Paste up to 10 domains into the free bulk domain + SSL checker to get registry expiry dates and served certificate dates in one go, or import straight from your registrar (see how to export your domain list from each registrar).
Part 2: The monthly renewal review (30 minutes)
- Sort by expiry date and look at everything expiring in the next 90 days.
- Confirm auto-renew is on for everything that should renew automatically, and that the card won't expire before the renewal date.
- Chase client approvals for anything the client pays for or must approve. Sixty days ahead is ideal.
- Check certificates that renew manually, and any with fewer than 30 days left.
- Add new domains and hosts from projects launched this month.
- Remove or flag domains for clients who've left. Decide in writing whether you're handing them over or letting them lapse.
- Invoice renewals you paid on clients' behalf.
Part 3: Pre-expiry checks for each domain
| When | Check |
|---|---|
| 60 days before | Confirm who pays, the renewal price and the card. Ask the client for approval if needed. Check the registrant email is current. |
| 30 days before | Renew manually if auto-renew is off. If it's on, make sure the card is valid. |
| 14 days before | Escalate anything still unrenewed to the account manager. |
| 3 days before | Last call. Renew it yourself and bill it back rather than let it lapse. |
| After renewal | Re-check the expiry date in RDAP. It should have moved forward by the renewal term. |
Part 4: Pre-expiry checks for each certificate
| When | Check |
|---|---|
| 30 days before | For automatic renewals, confirm the last renewal succeeded. Most ACME clients renew around 30 days before expiry, so a certificate with fewer than 30 days left often means renewal is failing. |
| 14 days before | For manual certificates, generate the CSR, complete validation and install. Check the full chain is served. |
| 3 days before | Escalate. An expired certificate shows a full-page browser warning, which is worse than a slow site. |
| After renewal | Check the certificate the host serves on every hostname, not just one. CDNs and load balancers can keep serving an old certificate. |
This matters more each year. Public TLS certificates issued from 15 March 2026 can last at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029 under CA/Browser Forum ballot SC-081v3. Any certificate you renew by hand will need attention several times a year. Read what the move to 47-day certificates means for agencies.
Part 5: Ownership and access hygiene
- Use role addresses such as [email protected] for registrar accounts, never personal inboxes.
- Turn on two-factor authentication on every registrar and DNS account.
- Store access securely in a shared password manager, not a spreadsheet.
- Lock domains against transfer unless you're moving them.
- Document handovers. When a client leaves, record that you transferred the domain or gave notice that you'll stop renewing it.
Part 6: Put it in your contracts
A lot of renewal pain is really ambiguity about responsibility. Add a clause to your maintenance or hosting agreement that says who registers domains, whose account they live in, who pays and how renewals are billed, and what happens to domains when the contract ends. Then your renewal checklist enforces something the client has already agreed to.
Using the template
The CSV template has one row per domain or certificate, with these columns: client, domain or host, type, registrar or CA, account owner, who pays, auto-renew, card expiry, expiry date, renewal cost, one tick column for each reminder (60, 30, 14 and 3 days), DNS host and notes. Import it into Google Sheets (File → Import) or open it in Excel, delete the sample rows and add your own. Use conditional formatting on the expiry column to colour anything under 30 days.
A spreadsheet works for 20 domains. Past that, it goes stale the week after someone builds it, which is why we built a tool that keeps the dates current automatically. More on that in how to track 100+ client domains without a spreadsheet.
Common gaps this checklist catches
- The forgotten second domain. Clients often own the .com and a country domain, or an old brand that redirects. The redirect breaks when that domain lapses, and with it any old links and printed materials.
- The mail server certificate. Websites usually renew automatically through the host. A self-managed mail server or a client's on-premise device often doesn't, and nobody looks at it until phones stop syncing email.
- The staging site that became production. A host that started as "staging" ends up linked from a client's app, on a manually installed certificate.
- The registrar account nobody can log in to. If the only person with the password has left, you'll find out on the day you need to renew. Test logins as part of the yearly review.
- Premium renewal prices. Some TLDs and premium names renew for far more than the first-year price. Record the real renewal cost so nobody is surprised when the invoice arrives.
How often to repeat each part
| Task | Frequency |
|---|---|
| Full inventory rebuild and registrar login test | Once a year |
| Renewal review and billing | Monthly |
| Pre-expiry checks | At 60, 30, 14 and 3 days for each domain; 30, 14 and 3 for each certificate |
| New project intake | At every launch |
| Client offboarding | When a contract ends |
Turn this checklist into automatic reminders
RenewRoster tracks every client's domain and SSL expiry dates, sends reminders at 60, 30, 14 and 3 days (under your agency's brand if you like) and gives you a monthly renewals report. Free for 5 domains, no card needed.