Abstract: A certificate renewal method includes a satellite certification authority (CA) receiving, from a central CA, permission configuration information including permission information for indicating that only renewal processes are executed, receiving a renewal request transmitted by a device, judging whether a renewal condition is satisfied, generating a new device certificate via a signing procedure implemented using a private key corresponding to a level 3 certificate of the satellite CA in response to determining that the renewal condition is satisfied, and transmitting the new device certificate to the device.