# SSL Certificate did not renew automatically **URL:** \ **Category:** General\ **Tags:** certificates\ **Created:** [April 28, 2022, 10:10am UTC](https://community.fly.io/t/ssl-certificate-did-not-renew-automatically/4924 "2022-04-28T10:10:53Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![greg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/greg/32/2119_2.png) [@greg](https://community.fly.io/u/greg)\ **Post date:** [April 28, 2022, 1:04pm UTC](https://community.fly.io/t/ssl-certificate-did-not-renew-automatically/4924/2 "2022-04-28T13:04:19Z")
_My_ understanding is if you have an A/AAAA record for your domain _or_ you have the acme-challenge CNAME, the SSL should renew by itself. As either method can be used for verification. In which case, _just_ a CNAME (so _not_ using A/AAAA _or_ the acme-challenge) would not be sufficient. If that’s correct that would explain the failure. As regards whether an A record _or_ CNAME is better, I believe for an apex domain (like [domain.com](http://domain.com)) you need to use an A record. But for subdomains (like [api.domain.com](http://api.domain.com)) you can use either. I _guess_ using an A record avoids one more DNS lookup. But since the IP per app _seems_ fixed I’m not sure there is any other benefit. --- _[View the full topic](https://community.fly.io/t/ssl-certificate-did-not-renew-automatically/4924)._