A digital signature certificate stops working the moment it expires. There is no grace period and no warning from the portal you are filing on — you simply cannot sign. Renewing a few weeks early avoids that entirely.
When to start
Begin two to four weeks before your expiry date. Note that the new validity runs from the date you renew, not from your old expiry date, so renewing far too early wastes days you have already paid for. Two to four weeks is the sweet spot.
The process
Renewal follows the same steps as a new certificate: share your certificate type and expiry date, submit the documents for that type, complete a video eKYC, and download the renewed certificate. The one difference is that no new USB token is dispatched — the renewed certificate installs onto the token you already have, which is why renewal costs less.
If it has already expired
Nothing is lost. An expired certificate is simply replaced with a fresh one through the same process. There is no penalty; you just cannot sign anything until the new certificate is issued, which is usually the same day.
Keep the token safe
Renewal depends on having your existing token. If it is lost or damaged, you will need a new token as well, which changes the cost. Store it somewhere you will find it in a year.