200, 100 and 47-day certificates. What changes for your site

Until March 2026, an SSL certificate could last 398 days: you renewed once a year and forgot about it. That is over. Browsers and the authorities that issue certificates voted to shorten them in three steps, and the first one is already in force.

If everything you run renews itself, you may not notice a thing. If any certificate is installed by hand, this article is for you.

The schedule

The CA/Browser Forum, where browsers and certificate authorities agree on the rules, decided it with ballot SC-081v3 in April 2025. Each date applies to certificates issued from that day on:

The last column matters more than it seems. To issue a certificate, the authority has to check the domain is yours. Today that check is valid for 200 days; in 2029 it will be valid for 10. In other words: almost every renewal will require proving again that the domain is yours.

A certificate issued before each date keeps its lifetime. Nothing has to change on the day itself, but the next one you issue falls under the new rule.

Let's Encrypt is moving on its own, and faster

Let's Encrypt, which issues free certificates for a large part of the web, already gave out 90-day certificates. Now it is shortening them too:

• 13 May 2026: an optional profile started issuing 45-day certificates to whoever asks for them.
• 10 February 2027: the default profile moves to 64 days.
• 16 February 2028: the default profile moves to 45 days.

And another change went by almost unnoticed: since 4 June 2025, Let's Encrypt no longer emails you when a certificate is about to expire. If you counted on that email as a safety net, it is gone. They themselves recommend using an external monitoring service.

What is going to break

With one certificate a year, a renewal could fail once a year. With 47-day certificates there are at least eight renewals a year: eight chances to fail. This is what usually fails:

• Paid certificates installed by hand in the hosting panel. At 47 days, manual renewal stops being a yearly chore and becomes almost a monthly one.
• The certificate renews, but the server keeps serving the old one. The new file is on disk, but nobody reloaded the web server and it still hands out the previous one. It happens more than you would think.
• Copies elsewhere. The certificate renews on the server, but there is a copy on the load balancer, the CDN or another server that nobody updates.
• Scheduled jobs with a fixed interval, such as "renew every 60 days". With 45-day certificates, that job is always late.
• DNS validation with expired credentials. If renewal has to create a DNS record and the DNS provider's API key no longer works, it fails silently.

How to get ready

1. Automate renewal with ACME (the protocol used by Let's Encrypt and more and more paid authorities). If your ACME client supports it, use ARI: the server tells it when to renew.
2. If you cannot use ARI, renew at two thirds of the certificate's life, not on a fixed date. That is what Let's Encrypt recommends.
3. Watch the certificate that is actually served, from outside, not the file on disk. The one that matters is the one the visitor gets.
4. Fit the alert to the new lifetime. With 47-day certificates, a "30 days left" alert would fire almost right after each renewal. What helps is knowing the renewal did not happen in time.

In MonitoraWeb we look at the certificate your site hands out, from outside, and the alert days are set per monitor: 1, 2, 3, 7, 14, 30 or 60. For a 90-day Let's Encrypt certificate, 14 days of margin is plenty. For a 47-day one, 7 or fewer works well.

Sources

• CA/Browser Forum, ballot SC-081v3: cabforum.org
• Let's Encrypt, from 90 to 45 days: isrg.org
• Let's Encrypt, end of expiry emails: letsencrypt.org and closing notice