SSL certificates are getting shorter lifetimes: what changes for you
Public TLS certificates are moving from about a year to 200 days, then 100, then 47 by 2029. The schedule, why it is happening, and how to make renewals automatic.
Published
Tool for this job: SSL Certificate Checker
For years, a public HTTPS certificate could last up to about 13 months. That is changing in steps. Under a schedule agreed in 2025 by the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules, the maximum lifetime falls to 47 days by 2029. If anyone renews your certificates by hand, this matters now.
The schedule
| Issued from | Max lifetime |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
The first step is already in force: certificates issued since March 2026 last at most 200 days. A certificate bought before then can still run to its original end date.
Why lifetimes are shrinking
- Less damage from mistakes: a certificate issued wrongly, or whose key leaks, stays usable for a shorter time.
- Revocation does not work well: browsers often cannot check reliably whether a certificate has been cancelled, so expiry is the dependable safety net.
- Fresher information: the domain ownership behind a certificate is re-checked more often.
- Forcing automation: frequent renewal makes manual processes impractical, and automated renewal is more reliable anyway.
What to do
- Find every certificate you rely on: websites, APIs, mail servers, load balancers, internal tools with public names.
- Check how each one is renewed. Many hosts and CDNs already renew automatically. Others depend on a person and a calendar reminder.
- Automate the manual ones with the ACME protocol, which most certificate authorities support, using the client your server or platform recommends.
- Monitor expiry anyway. Automation fails quietly when DNS changes or a firewall blocks validation.
Check what you have now
Enter each domain in the SSL Certificate Checker. It shows the valid-from and valid-until dates, days remaining, the issuer and whether the chain is trusted. It also checks mail and other ports, such as 465, 993 and 995, which are easily forgotten. A certificate issued recently with a lifetime of about 200 days, or 90 days for many free authorities, tells you the renewal clock is short.
What 47 days means in practice
With a 47-day maximum, certificates are typically renewed about once a month, leaving a margin before expiry. That is roughly twelve renewals a year per certificate, every year. For an organisation with dozens of certificates, a manual process would mean a renewal almost every working day. Automation is not optional at that rate; the time to set it up is while lifetimes are still 200 or 100 days.
Places that tend to break
- Certificates installed by hand on appliances, printers and older load balancers.
- Certificates copied between servers, where only one copy gets renewed.
- Pinned certificates in mobile apps, which must be updated before the old certificate is replaced.
- Mail servers, whose certificates are rarely checked in a browser.
For a step-by-step expiry check, see how to check when an SSL certificate expires. If some clients report errors after a renewal, see fixing an incomplete certificate chain.