The CA advertises a renewalInfo endpoint in its directory. The client derives a certificate identifier from the authority key identifier and the serial number, fetches suggestedWindow (start and end timestamps, plus an optional explanationURL) and picks a random time inside the window. A Retry-After header tells it when to check again. New orders can name the certificate they replace in a replaces field.
ARI matters most during incidents: in 2024–2025 several CAs had to revoke large batches of certificates within the five-day window of the Baseline Requirements, and clients polling ARI renewed automatically instead of breaking. Let's Encrypt, Google Trust Services and other ACME CAs support it, as do Certbot, lego, Caddy and cert-manager.