diff --git a/api/kiwi_vpn_api/easyrsa.py b/api/kiwi_vpn_api/easyrsa.py
index 25c59cb..a83bbda 100644
--- a/api/kiwi_vpn_api/easyrsa.py
+++ b/api/kiwi_vpn_api/easyrsa.py
@@ -312,6 +312,9 @@ class EasyRSA:
             dn.common_name,
             "nopass",
 
+            # allow renewal 14 days before cert expiry
+            EASYRSA_CERT_RENEW="14",
+
             **dn.easyrsa_env,
         )