Put renewal on an owned calendar

Record certificate serial/fingerprint, issuer, validity dates, covered domains, logo checksum, hosted URL, BIMI selectors, provider acceptance, account owner, legal contact, and renewal lead time. Alert early enough for organization and mark validation, procurement, and correction—not only a few days before expiry.

Recheck the BIMI Group’s current issuer information and each target provider’s accepted certificate classes and issuers. Acceptance can differ, and an issuer’s ability to sell a certificate does not guarantee every provider will use it.

Freeze the intended mark scope

Ask brand and legal owners whether the logo, organization name, trademark/prior-use evidence, domain set, or corporate entity changed. A rebrand is a new evidence problem, not merely a renewal file swap. Use the exact approved SVG Tiny P/S and store its checksum.

Submit only through the verified issuer workflow. Keep validation documents in approved systems and do not attach sensitive corporate evidence to general engineering tickets.

Validate before changing DNS

Inspect the issued certificate with approved tools. Confirm validity, chain, subject/organization information, domain coverage, mark representation, and expected BIMI extended usage. Verify the corresponding SVG. Host the new PEM at a new stable HTTPS URL, then check TLS, status, MIME type, size, and public retrieval.

Do not overwrite the old evidence file before the new pair passes. This preserves a clear rollback and avoids caches serving mixed content at one URL.

Switch and observe

Update the selector’s a= value—and l= only if the approved logo URL changed—through DNS change control. Record old/new records, TTLs, time, and rollback. Query authoritative and recursive DNS, then send fresh aligned messages to the provider matrix.

Providers can cache DNS, assets, and UI decisions. Record exact observations and retest times without promising an instant universal update. Keep the old file available through the transition window.

Close the renewal

After acceptance is observed, restrict or remove obsolete evidence according to policy, update monitoring and the next renewal date, and document providers that remain unknown. The renewal succeeded when the new certificate is valid, retrievable, matched to the approved logo/domains, and observed where supported—not merely when the issuer sent a download link.