Shorter certificate lifetimes and what they mean for a small site

For years a website’s certificate could be installed and left alone for about a year. Since September 2020 the ceiling had been 398 days. That ceiling began coming down on March 15, 2026, and it keeps falling until 2029.

The schedule

The rules come from the CA/Browser Forum, where certificate authorities and browser makers agree on the Baseline Requirements every publicly trusted certificate has to meet. In April 2025 its members passed Ballot SC-081 without a single vote against, from the authorities or from Apple, Google, Microsoft and Mozilla. It sets the longest a certificate may be valid by the date it is issued:

• Issued from March 15, 2026: 200 days.
• Issued from March 15, 2027: 100 days.
• Issued from March 15, 2029: 47 days.

Domain validation shrinks on the same dates. A certificate authority may now reuse its proof that you control a domain for 200 days, then 100 days from March 2027, and only 10 days from March 2029. By the last step, control of the domain has to be shown again almost every time a certificate is issued.

The ballot’s reasoning leans partly on rules that already exist. Certificate authorities must revoke a certificate within 24 hours in some situations, so any site may be asked to replace its certificate within a day. A site that can do that on demand can do it on a schedule.

Why renewing by hand stops working

At 398 days, renewal was a yearly chore that fit in a calendar. At 200 days it comes round twice a year, at 100 days almost four times, and at 47 days at least eight. Every one is a chance for the reminder to reach someone who has left, or for the new certificate to go onto one server and not the next. An expired certificate does not fail gently either: browsers put a full-page warning in front of the site.

The reminders are thinning out as well. Let’s Encrypt, the nonprofit certificate authority that issues free certificates, stopped sending expiry emails on June 4, 2025. Its announcement of shorter lifetimes says manual renewal is not recommended and will only have to happen more often. Its own default certificates, 90 days today, are scheduled to drop to 64 days in February 2027 and to 45 days in February 2028.

How automatic renewal works

Automatic renewal runs on ACME, a protocol the IETF published as RFC 8555 in March 2019. A small client on the server, or the hosting company’s own system, asks the certificate authority for a certificate and proves control of the domain, either by serving a file from the website or by adding a TXT record to its DNS. It then installs the new certificate and reloads the web server. On a timer, the whole cycle repeats well before the old certificate runs out, and nobody has to touch it.

A newer extension improves the timing. ACME Renewal Information, published as RFC 9773 in June 2025, lets the certificate authority send the client a suggested window for its next renewal. Let’s Encrypt recommends it, along with renewing about two thirds of the way through a certificate’s life rather than at a fixed interval such as every 60 days.

What to check on a small site

• On shared hosting or a site builder, find out whether the host renews the certificate or you do. The control panel usually says which, and a certificate bought elsewhere and uploaded by hand tends to be the one that gets missed.
• On your own server, confirm the ACME client runs on a schedule and that the web server reloads after each renewal. A renewed certificate that never gets loaded still expires in the browser.
• List every place the certificate is installed, such as a mail server, a load balancer or a CDN. Each one needs the new copy.
• If you pay for a one- or two-year certificate product, ask how reissued certificates will be delivered once the limit falls to 100 days, since installing each one becomes your job.
• Watch the expiry date from outside the server, so a failed renewal shows up while there are still days left to fix it.