Certificate Lifetimes Are Shrinking Fast
6 min read
If somebody renews your site certificate by hand once a year, that arrangement is on a clock. Maximum certificate validity is being cut in stages, and the first stage already took effect in March 2026. For a business owner the point is not what the rules say. The point is that a yearly chore becomes a quarterly one and then a monthly one, until relying on somebody remembering is itself the risk. This is what you will run into and how to get ahead of it.
1. The maximum lifetime keeps dropping
First, what an SSL certificate actually is. It is an electronic statement issued by a certificate authority that lets a browser confirm a domain really belongs to you. The padlock in the address bar and the https at the front of the URL are that certificate doing its job. Every certificate has a validity period, and once it passes, browsers stop trusting it.
What has changed is how long that period is allowed to be. The rules are set by the CA/Browser Forum, where browser makers and certificate authorities sit together. Its SC081v3 ballot passed and cuts the maximum validity from 398 days to 47 days in stages, starting in March 2026 and finishing in March 2029.
| From | Maximum certificate validity |
|---|---|
| Before 15 March 2026 | 398 days, roughly thirteen months |
| 15 March 2026 | 200 days, roughly six and a half months |
| 15 March 2027 | 100 days, roughly three months |
| 15 March 2029 | 47 days, roughly six weeks |
It is already August 2026, so the first stage has been in force for months. Anything issued since March this year runs to 200 days at most and the one-year option is gone. This is not something to prepare for later.
One qualification. The dates and day counts above come from certificate authority announcements rather than a line-by-line reading of the rules themselves. The direction is not in doubt, but when you actually renew, go by whatever your own supplier has published at the time, because some authorities shorten ahead of the requirement.
2. How you got the certificate decides how much this hurts
The same change lands very differently depending on one thing, and it is not the size of your site. It is how the certificate got installed. Find yourself below.
Four common setups, four different outcomes
- Your host or site platform handles it. Most shared hosting, cloud platforms and website builders issue and renew automatically, and you may never have seen the word certificate. Barely affected.
- A free certificate with automatic renewal already running. These were always short-lived. Let's Encrypt certificates are valid for 90 days by default and the project recommends renewing every 60 days, so a 200-day ceiling changes nothing at all.
- A one-year certificate bought and installed by hand. This is the setup that breaks first. What used to happen once a year now happens twice, and in a few years it becomes monthly.
- Your own server, renewed whenever somebody remembers. A calendar reminder is not automation. It is the manual case with an extra person who can forget.
Line those four up and something slightly counterintuitive falls out. Exposure has nothing to do with how much you paid or how technical you are. It tracks one thing only: whether the renewal is automated. Free certificates come out safest, because they were designed from day one on the assumption that nobody will remember.
3. What actually happens on the day it expires
An expired certificate does not make a site slower or uglier. The browser stops the visitor before the page loads, with a full screen of red warning that takes two or three clicks to get past. Almost nobody gets past it. Your search listings still work, the click still happens, and it lands on a warning. That day's traffic is effectively zero.
The website is not the only casualty. The same certificate often covers mail, payment callbacks and whatever machine-to-machine connections you have. None of those has a screen, so nothing shows a warning. You find out because an order confirmation never went out, or because an integration quietly stopped responding.
4. Setting up automatic renewal
Automatic renewal sounds like engineering work. For most people it is confirming one switch. Three situations, in order of how common they are.
If your host or site builder supplies the certificate, log into the control panel, find the certificate or security page, and confirm automatic renewal is on. Then look at the date of the last successful renewal. If it stopped a long time ago, a renewal failed at some point and nobody was told.
If you run your own server or VPS, install a tool that requests and renews certificates for you. Every mainstream Linux distribution packages one. Set it to check daily and replace the certificate well before expiry. Once it is installed, force a renewal by hand to prove the whole thing runs end to end, rather than discovering a permissions problem on expiry day.
The third situation is a certificate installed in more than one place: one copy on the web server, one on the mail server, one on whatever sits in front distributing traffic. This is the one that slips through. The renewal succeeds, the new file reaches one machine, and the others carry on serving the old certificate. The question to ask is not whether the certificate renewed. It is whether the renewed certificate reached everything that uses it.
5. Free certificates against paid ones
Something that will not please everyone selling certificates: for the vast majority of small business websites, a free certificate is enough. The encryption is identical, browsers trust it identically, and the padlock a visitor sees looks exactly the same. A free certificate is not a cut-down version. It protects the connection just as well as one costing a few thousand a year.
Paid certificates sell three other things. The first is a higher level of validation: a free certificate proves you control the domain, while paid tiers check company registration records and write your company name into the certificate. The second is service, meaning somebody to call, a warranty clause and a management console. The third is compatibility, because some older devices and specific platforms only recognise a handful of authorities.
On the application itself, free certificates hide the process inside the tooling. You prove control of the domain, usually by letting the tool place a file on the site or add a DNS record, and it is done in minutes. Paid certificates add a human review step, and the company-validated tiers ask for registration documents, so waiting several days is normal.
6. Three things worth doing now
None of this needs to wait for an incident. These three take under an hour and at least tell you where you stand.
First, establish who manages the certificate today and how it renews. If the answer is that the agency who built the site handled it and nobody can reach them, that is the actual problem to solve. Second, write down the expiry date and set a reminder two weeks ahead. Even with automation in place, that reminder is your last line of defence. Third, record how renewal works and which machines carry a copy, and put it in the handover document. People leave, documents stay.
When is it worth paying somebody? If there is one certificate on one machine and your host renews it, confirming the switch yourself is enough and you do not need to spend anything. If certificates are spread across several machines, or tied into mail and payments, it is worth having the automation and monitoring built properly once. That is a one-off job, and after it every future reduction stops being your problem.
Shrinking certificate lifetimes require no technical understanding on your part. They mean one thing: renewing by hand has gone from mildly annoying to eventually missed. Go and find out how your certificate renews today, and if the answer depends on a person remembering, replace that person with a program. Do it once and none of the later reductions will reach you.
Common questions
- How much does an SSL certificate cost, and can I use a free one?
- For most small business sites a free certificate is fine. The encryption strength and the padlock are identical to a paid one. Paid certificates run from roughly NT$1,000 to well over NT$10,000 a year and sell higher validation, a support contact and a management console. That money is only worth spending when a contract or procurement rule demands a validation level, your equipment cannot do automated issuance, or you have enough certificates to need central management.
- With lifetimes shrinking, how often do I have to renew?
- It depends when the certificate was issued. Anything issued after March 2026 runs to 200 days at most, dropping to 100 days from March 2027 and 47 days from March 2029. In practice nobody waits for the final day, and renewal tools typically replace a certificate once a third of its life remains. The number to remember is not any of those figures. It is that renewal should belong to a program rather than to somebody's memory.
- How do I get an SSL certificate installed?
- On shared hosting or a website builder there is usually a switch in the control panel; turn it on and the platform requests and renews for you. On your own server, install a renewal tool, which proves you control the domain by placing a file on the site or adding a DNS record. Paid certificates are bought from an authority and go through a human review, and the company-validated tiers will ask for registration documents.