Renewal Prep

---
name: "GoGetSSL Renewal Prep"
description: >
  Getting a GoGetSSL certificate renewal or reissue ready before anyone
  places it in the client area: choosing and pricing a product, checking
  wildcard and SAN support, confirming which approver email addresses email
  domain validation will accept, decoding the client's CSR to catch
  mistakes, and confirming the prepaid balance covers the renewals.
when_to_use: >-
  When an MSP is about to renew, replace or reissue a client certificate
  bought through GoGetSSL and wants the quote, validation path and CSR
  checked first. Use when: ssl renewal quote, certificate price, which ssl
  product, wildcard certificate cost, dcv approver email, domain validation
  email, check csr, decode csr, or enough balance to renew.
---

# GoGetSSL Renewal Prep

## Overview

Renewals fail for boring reasons: the approver mailbox does not exist, the
CSR has the wrong common name or a 2048-bit key the client's policy forbids,
the product quoted does not cover the wildcard the client actually uses, or
the prepaid balance is short on the day. This skill checks each of those
with read-only GoGetSSL tools so the person placing the order in the
GoGetSSL client area gets it right first time.

This plugin **cannot place, renew or reissue an order**, resend a validation
email, or change a DCV method. Every tool used here is read tier and none is
admin-gated in Conduit.

## Anti-triggers

- **Finding which certificates expire**: use
  [certificate-expiry](../certificate-expiry/SKILL.md) first, then come back
  here for each order that needs action.
- **Reconciling what renewals cost after the fact**: use
  [billing-reconciliation](../billing-reconciliation/SKILL.md).

## Common Workflows

### 1. Start from the existing order

Call `gogetssl_orders_get_status` on the expiring order. Note:

- the product, so the renewal can match it
- the domains and SANs covered, so nothing is dropped
- the validation method used last time
- `end_date` versus `valid_till`: if the order is still active, its reissue
  flag allows a reissue, and the subscription runs past the certificate's
  expiry, this is a **reissue** inside the paid period, and no purchase is
  needed. Say when the subscription ends, because a renewal purchase is
  still due at `end_date`

### 2. Pick and price the product

| Question | Tool |
|----------|------|
| Which products exist, and which support wildcard, SAN and which DCV methods? | `gogetssl_products_list` |
| Brand, validation type (DV, OV, EV) and price per period | `gogetssl_products_list_ssl` |
| Just the partner price per product and period | `gogetssl_products_list_prices` |
| Warranty, free reissues, refund window, SAN and wildcard detail for one product | `gogetssl_products_get` |

Match the validation type of the old certificate unless the client asked to
change it. Moving from OV to DV loses the organisation name in the
certificate, which some clients notice.

The prices returned are **your partner cost**, not what you charge the
client. Add your margin before quoting.

### 3. Confirm the email validation path

If the renewal will use email domain control validation, call
`gogetssl_dcv_get_domain_emails` with the bare domain (for example
`contoso.com`, no scheme, path or `*.`). It returns the addresses GoGetSSL
will accept, typically role addresses such as `admin@` and `hostmaster@` at
the domain. Use the list the tool returns rather than assuming.

Check that at least one of those mailboxes exists and that someone can read
it. If none does, plan on DNS (CNAME) or HTTP file validation instead, and
choose that method when the order is placed. This lookup is a read-only POST
and changes no order.

### 4. Check the CSR

If the client or their hosting provider supplied a CSR, pass the
`-----BEGIN CERTIFICATE REQUEST-----` block to `gogetssl_csr_decode`.
Compare the result against the order:

- common name matches the domain being renewed
- organisation and location are right for an OV or EV product
- SANs, if any, match what the client expects
- key size meets the client's policy

Never pass a private key. The tool refuses any input containing one, and
the plugin deliberately does not expose CSR generation because that returns
a private key. CSRs are limited to 4000 characters. This tool sends no
GoGetSSL credentials.

### 5. Check the balance

Call `gogetssl_account_get_balance` and compare it with the summed partner
prices of everything due. GoGetSSL takes payment from the prepaid balance,
so a short balance stops renewals. Also call `gogetssl_orders_list_unpaid`:
an unpaid order from an earlier attempt may already cover the domain.

## Gotchas

- `gogetssl_dcv_get_domain_emails` rejects wildcards. For a `*.contoso.com`
  certificate, look up `contoso.com`.
- Prices come back per period. Multi-year subscriptions are usually cheaper
  per year, but the certificate inside still has to be reissued as each one
  expires. Check `gogetssl_products_get` for the free reissue allowance.
- An LEI order is not a certificate. For LEI renewals, read the current
  state with `gogetssl_lei_get_status` (status, LEI code and validity dates);
  the renewal itself is placed in the client area.

## Related Skills

- [certificate-expiry](../certificate-expiry/SKILL.md): find what needs renewing
- [billing-reconciliation](../billing-reconciliation/SKILL.md): balance and invoices
- [api-patterns](../api-patterns/SKILL.md): argument formats and errors