Use Paypal API, so your system will return a callback notification when the payment processed by Paypal success or fail. Also, Paypal API offers the recurring billing for weekly, monthly, or yearly, so it will keep your clients being authorized using the same certificate generated by your system for yearly range, and system will receive the newly notification every year for certification renewal. From here, you could process the "stamp" on the pdf with the certificate you mean here based on success or failed notification I explained above. What PDF engined do you have on your web server?