diff --git a/README.md b/README.md
index a942ae6..ac56663 100644
--- a/README.md
+++ b/README.md
@@ -107,24 +107,46 @@ gl.add({
 });
 ```
 
-| Parameter       | Description                                                                        |
-| --------------- | ---------------------------------------------------------------------------------- |
-| subject         | the first domain on, and identifier of the certificate                             |
-| altnames        | first domain, plus additional domains<br>note: the order should always be the same |
-| subscriberEmail | if different from the default (i.e. multi-tenant, whitelabel)                      |
-| agreeToTerms    | if subscriber is different from the default                                        |
+| Parameter       | Description                                                                                  |
+| --------------- | -------------------------------------------------------------------------------------------- |
+| subject         | the first domain on, and identifier of the certificate                                       |
+| altnames        | first domain, plus additional domains<br>note: the order should always be the same           |
+| subscriberEmail | if different from the default (i.e. multi-tenant, whitelabel)                                |
+| agreeToTerms    | if subscriber is different from the default                                                  |
+| challenges      | (same as main config) use if this site needs to use non-default http-01 or dns-01 validation |
 
-### Issue and Renew Certificates
+### Issue Certificates
+
+```js
+return greenlock.get({ servername }).then(function(site) {
+	if (!site) {
+		console.log(servername + ' was not found in any site config');
+		return;
+	}
+
+	var privkey = site.pems.privkey;
+	var fullchain = site.pems.cert + '\n' + site.pems.chain + '\n';
+	console.log(privkey);
+	console.log(fullchain);
+});
+```
+
+| Parameter  | Description                                            |
+| ---------- | ------------------------------------------------------ |
+| servername | the first domain on, and identifier of the certificate |
+
+### Renew Certificates
 
 This will renew only domains that have reached their `renewAt` or are within the befault `renewOffset`.
 
 ```js
-return greenlock.renew().then(function(results) {
+return greenlock.renew({}).then(function(results) {
 	results.forEach(function(site) {
 		if (site.error) {
 			console.error(site.subject, site.error);
 			return;
 		}
+		console.log('Renewed certificate for', site.subject, site.altnames);
 	});
 });
 ```
@@ -133,11 +155,18 @@ return greenlock.renew().then(function(results) {
 | ------------- | ---- | ------------------------------------------------------------------------------- |
 | (optional)    |      | ALL parameters are optional, but some should be paired                          |
 | force         | bool | force silly options, such as tiny durations                                     |
-| duplicate     | bool | force the domain to renew, regardless of age or expiration                      |
 | issuedBefore  | ms   | Check domains issued before the given date in milliseconds                      |
 | expiresBefore | ms   | Check domains that expire before the given date in milliseconds                 |
 | renewBefore   | ms   | Check domains that are scheduled to renew before the given date in milliseconds |
 
+## Force a certificate to renew
+
+```js
+greenlock.update({ subject, renewAt: 0 }).then(function() {
+	return greenlock.renew({});
+});
+```
+
 <!--
 | servername  | string<br>hostname   | renew the certificate that has this domain in its altnames (for ServerName Indication / SNI lookup) |
 | renewOffset | string<br>+ duration | renew domains that have been **issued** after the given duration. ex: '45d' (45 days _after_)       |
diff --git a/certificates.js b/certificates.js
index e0aa2b7..ff8496a 100644
--- a/certificates.js
+++ b/certificates.js
@@ -93,7 +93,11 @@ C._rawGetOrOrder = function(gnlck, mconf, db, acme, chs, acc, email, args) {
 		});
 
 		// No choice but to hang tight and wait for it
-		if (!pems) {
+		if (
+			!pems ||
+			pems.renewAt < Date.now() - 24 * 60 * 60 * 1000 ||
+			pems.expiresAt <= Date.now() + 24 * 60 * 60 * 1000
+		) {
 			return p;
 		}
 
diff --git a/greenlock.js b/greenlock.js
index d8f11aa..9bb2f16 100644
--- a/greenlock.js
+++ b/greenlock.js
@@ -90,7 +90,15 @@ G.create = function(gconf) {
 	// and duration parsing, that a manager must implement
 	greenlock.add = function(args) {
 		return greenlock._init().then(function() {
-			return greenlock._add(args);
+			return greenlock._add(args).then(function(result) {
+				greenlock.renew({}).catch(function(err) {
+					if (!err.context) {
+						err.contxt = 'renew';
+					}
+					greenlock.notify('error', err);
+				});
+				return result;
+			});
 		});
 	};
 	greenlock._add = function(args) {
@@ -265,6 +273,7 @@ G.create = function(gconf) {
 			})
 			.then(function(results) {
 				if (!results || !results.length) {
+					// TODO throw an error here?
 					return null;
 				}
 
diff --git a/package-lock.json b/package-lock.json
index 5887966..ae83f62 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
 	"name": "@root/greenlock",
-	"version": "3.0.11",
+	"version": "3.0.12",
 	"lockfileVersion": 1,
 	"requires": true,
 	"dependencies": {
diff --git a/package.json b/package.json
index 3fd6ed1..8d15735 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@root/greenlock",
-	"version": "3.0.11",
+	"version": "3.0.12",
 	"description": "The easiest Let's Encrypt client for Node.js and Browsers",
 	"homepage": "https://rootprojects.org/greenlock/",
 	"main": "greenlock.js",