diff --git a/tests/test_server.py b/tests/test_server.py
index 944c71e..8a80619 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -291,6 +291,43 @@ class TestServerComponent(unittest.TestCase):
             if os.path.exists(test_cert_dir):
                 shutil.rmtree(test_cert_dir, ignore_errors=True)
 
+    def test_cert_validity_and_hub_pki_renewal(self):
+        test_cert_dir = "test_certs_renew"
+        try:
+            ca_cert, ca_key, ca_pem, _ = Server.enrollment.generate_ca_if_needed(cert_dir=test_cert_dir)
+            srv_cert, srv_key, srv_pem, _ = Server.enrollment.generate_server_cert_if_needed(
+                ca_cert, ca_key, hostnames=["127.0.0.1"], cert_dir=test_cert_dir
+            )
+
+            # 1. Freshly generated certificates should NOT be expiring soon with standard 30-day threshold
+            self.assertFalse(Server.enrollment.is_cert_expiring_soon(ca_pem, threshold_days=30))
+            self.assertFalse(Server.enrollment.is_cert_expiring_soon(srv_pem, threshold_days=30))
+
+            # 2. Huge threshold (e.g. 5000 days) should flag expiration
+            self.assertTrue(Server.enrollment.is_cert_expiring_soon(srv_pem, threshold_days=5000))
+
+            # 3. check_and_renew_hub_pki with standard threshold should report no renewal needed
+            ca_renewed, srv_renewed = Server.enrollment.check_and_renew_hub_pki(cert_dir=test_cert_dir, threshold_days=30)
+            self.assertFalse(ca_renewed)
+            self.assertFalse(srv_renewed)
+
+            # 4. In-flight reload of SSLContext
+            ssl_ctx = Server.init_mtls_server_context(cert_dir=test_cert_dir)
+            Server.SERVER_STATE["ssl_ctx"] = ssl_ctx
+            Server.SERVER_STATE["config"] = {"db_path": self.test_db, "cert_dir": test_cert_dir, "tcp_host": "127.0.0.1"}
+
+            # Trigger rotation using high threshold
+            rotated = Server.check_and_rotate_server_certs(cert_dir=test_cert_dir, hostnames=["127.0.0.1"], threshold_days=5000)
+            self.assertTrue(rotated)
+
+            # Check that backup files were generated
+            bak_files = [f for f in os.listdir(test_cert_dir) if f.endswith(".bak")]
+            self.assertGreater(len(bak_files), 0)
+        finally:
+            import shutil
+            if os.path.exists(test_cert_dir):
+                shutil.rmtree(test_cert_dir, ignore_errors=True)
+
 
 if __name__ == "__main__":
     unittest.main()