Force a re-issue of an existing certificate, ignoring the 30-day renewal window. ASYNC, the same HTTP-01 path as issue on the same row. An active certificate STAYS active and keeps serving while challenge carries the attempt: on success the certificate is replaced and re-stamped, on failure last_error is set and the current one keeps serving. A failed or expired row flips to challenge and ends active or failed like issue. Poll get_ssl_certificate until challenge is null. Use after a DNS or CA fix, or to recover a lapsed certificate. 409 conflict: issuance_already_in_progress (the daily sweep's attempt included), cannot_issue_deleted_certificate, acme_unreachable; an active row is not refused.

Contract:

• MCP tool renew_ssl_certificate, registry package mcp.id/ssl_certificates, mount id.partner.
• Operation action, response envelope action_async.
• Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.