SSL certificate lifetimes are getting shorter: 200, 100, then 47 days

If you renew your TLS certificates by hand once a year, that routine has a limited life. The maximum lifetime of a public certificate is being cut in three steps, down to 47 days.

The first step is already in force. Here is the schedule, what it breaks, and how to check where you stand.

The schedule

The CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules for public certificates, passed ballot SC-081. It steps the maximum lifetime of a public TLS certificate down like this:

• Until 14 March 2026: 398 days.
• From 15 March 2026: 200 days.
• From 15 March 2027: 100 days.
• From 15 March 2029: 47 days.

The date that counts is the day the certificate is issued. A certificate issued before a deadline keeps its old lifetime until it expires. There is no grace period for new ones.

The time a certificate authority may reuse a domain validation also shrinks, down to 10 days by 2029. In practice that means you cannot "prove the domain once" and renew for a year after.

What does this change for you?

The rule applies to publicly trusted certificates, the ones browsers accept. It does not apply to certificates from your own internal certificate authority.

For a public certificate, the number of renewals per year goes up:

• At 398 days you renewed about once a year.
• At 200 days it is about twice a year.
• At 100 days it is about four times a year.
• At 47 days it is about eight times a year.

Each renewal is a chance for something to go wrong. If renewal is automatic and works, you will not notice. If any part of it is manual, you will.

What breaks first

These are the places where short certificates hurt, roughly in the order we expect teams to find them:

1. Manual renewals. A calendar reminder and a person with the right access. Fine once a year, painful eight times a year.
2. Forgotten hostnames. A staging server, a vendor-hosted page on your domain, an old campaign site. Nobody owns it, so nobody renews it. See find forgotten subdomains and expiring certificates.
3. Automation that quietly stopped. A DNS record that changed, an API token that expired, a server that moved. The renewal job fails and nothing tells you until the certificate runs out.
4. Certificates copied into places. A certificate pasted into a load balancer, a CDN, a mail server or a device. The renewal updates one copy and not the others.
5. Pinned certificates. An app or partner system that trusts one specific certificate breaks on every renewal.

What to do

You do not need to wait for 2029. This is the work, in order:

1. List every public certificate you own. Search the Certificate Transparency logs for %.yourdomain.com. It is free and shows names you forgot. Our free domain check does this for you.
2. Mark which ones renew automatically. For each, ask: what renews it, and what happens when that fails? "Somebody will remember" is the wrong answer.
3. Automate what you can. ACME clients and most hosting platforms renew on their own. Moving from yearly manual renewals to automatic ones is the single biggest fix.
4. Find the copies. Wherever a certificate is installed by hand, write down where. Those are your weak spots.
5. Watch the expiry dates anyway. Automation is a plan, not a guarantee. An independent alert that says "this certificate expires in 14 days and has not been renewed" is how you catch a broken job while there is still time.

Do not rely on the CA's reminder email

Many teams count on the "your certificate is about to expire" email from their certificate authority. It goes to one address, often a person who has left. Some authorities have stopped sending these emails altogether. Treat it as a bonus, not the system.

How StackClock helps

Add a domain and we search the Certificate Transparency logs for hostnames under it that have a valid certificate. You approve the ones you want tracked, and each becomes a TLS certificate asset with its own expiry date. We re-check weekly and email you 60, 30, 14, 7 and 1 days before anything expires.

Shorter certificates mean that run of reminders matters more, not less. With a 47-day certificate, the 60-day warning is longer than the certificate's whole life, so the 14, 7 and 1 day warnings are the ones that will matter.

Start with one search: run your main domain through the free check and read the list. If you want the dates to remind you before they hit, start free. The Free plan covers up to 5 assets. See pricing for the rest.

It is the same idea as in the deadlines that break production: put every date in one place, with an owner, and get warned early.