TLS Certificates in 2026: Why Lifetimes Are Shrinking to 47 Days, What Breaks When a Certificate Expires, and How to Automate Renewal Before It Bites
- Internet Pros Team
- September 13, 2026
- Networking & Security
The padlock in the address bar has been quietly counting down for years, but it used to count slowly. A public TLS certificate could last over a year, so renewal was an annual chore somebody occasionally forgot. That era is ending on a fixed schedule. Browser makers and certificate authorities have agreed to cut the maximum lifetime of a public certificate in stages until, in 2029, no certificate trusted by a browser can live longer than 47 days. For any business that still renews by hand, the question is no longer whether an expired certificate will take a site offline, but how soon.
The Schedule Is Already Running
In 2025 the CA/Browser Forum, the body where browser vendors and certificate authorities set the baseline rules for public certificates, approved a ballot originally proposed by Apple that shortens lifetimes in steps. The first step has already happened. Since March 15, 2026 a newly issued public TLS certificate cannot be valid for more than 200 days. The next steps are the ones that force a change.
| Issued on or after | Maximum certificate lifetime | Domain validation reuse | Renewals per year in practice |
|---|---|---|---|
| Before March 2026 | 398 days | 398 days | One |
| March 15, 2026 | 200 days | 200 days | Two |
| March 15, 2027 | 100 days | 100 days | Four to five |
| March 15, 2029 | 47 days | 10 days | Around twelve with a safe margin |
The last column is the one that matters operationally. Nobody renews a certificate on the day it expires. With a sensible buffer, a 47 day certificate gets replaced roughly every month, and the ten day limit on reusing domain validation means the certificate authority must re-confirm control of the domain almost every time. A manual process that works once a year does not survive being run twelve times.
Why Shorter Is Safer
The reasoning starts with an uncomfortable fact: certificate revocation does not work well. When a private key leaks or a certificate is issued in error, the certificate authority can revoke it, but browsers largely stopped checking revocation in real time because the lookups were slow, leaked browsing history and failed open when the server did not answer. A stolen certificate can stay usable until it simply expires, so short lifetimes put a hard ceiling on the exposure.
The second reason is stale information. A certificate asserts that whoever requested it controlled the domain at the moment of validation. Domains get sold and cloud addresses get reclaimed by strangers, and a certificate that outlives those changes is vouching for something no longer true.
The third reason is agility. When a weakness appears in an algorithm, or when the industry needs to move to post-quantum signatures, every certificate in circulation has to be replaced. If certificates last a year and renewal is manual, that migration takes years. If they last a month and renewal is automatic, the whole web can turn over in weeks.
Short certificate lifetimes are not really a security control. They are a forcing function. The point is to make manual renewal so painful that everyone automates, because automation is what actually makes the web recoverable.
How ACME Automation Works
The Automatic Certificate Management Environment protocol, standardised after Let’s Encrypt proved the model at scale, is how most of the web already renews without human involvement. A client on your server generates a key, asks the certificate authority for a certificate, proves control of the domain by answering a challenge, installs the result and schedules the next run. Let’s Encrypt has issued 90 day certificates for a decade, so many sites will barely notice the new rules.
The challenge type decides where automation can reach. An HTTP challenge places a token at a well known path on the website, which is simple but requires the server to be publicly reachable on port 80. A DNS challenge publishes a token as a TXT record, which works for wildcard certificates and internal hosts but requires API access to your DNS provider. Delegating only the _acme-challenge name to a separate zone keeps those credentials narrowly scoped.
The newer piece is ACME Renewal Information, an extension that lets the certificate authority tell each client when it should renew. The authority can spread renewals out and, after a mass revocation, ask affected clients to renew immediately, turning a weekend of manual reissuance into a background job.
Where Renewal Usually Breaks
- Appliances and load balancers. Firewalls, VPN gateways and hardware load balancers often need a certificate uploaded through a web console with no ACME client at all.
- Copies of the same certificate. A certificate renewed on the origin but pasted manually into a CDN, a mail server or a monitoring tool still expires everywhere it was copied.
- Pinned certificates. Mobile apps and embedded devices that pin a specific certificate break the moment it rotates. Pin to a public key or a CA you control, or stop pinning.
- Renewal that succeeds but never reloads. The new file lands on disk while the web server keeps serving the old certificate from memory until it finally expires.
- Silent failures. A renewal job that fails quietly for weeks is invisible until the outage. Monitoring must check the certificate actually being served, not the cron log.
What an Expired Certificate Really Costs
An expired certificate is not a degraded experience, it is a full stop. Browsers show a warning most visitors will not click through, API clients refuse the connection and payment integrations fail. In 2018 a single expired certificate inside telecom equipment knocked out mobile data for millions of subscribers across several countries for most of a day. And a security warning on a checkout page teaches customers to distrust you at exactly the wrong moment.
A Practical Plan for Business Websites
- Build an inventory first. Certificate Transparency logs publicly record every certificate issued for your domains. Searching them is the fastest way to find the certificates nobody remembers ordering.
- Automate everything that faces the internet. Use ACME wherever it is supported, and prefer hosting, CDN and load balancer products that manage certificates for you.
- Publish CAA records. A CAA record in DNS lists which certificate authorities may issue for your domain, which stops a forgotten vendor or an attacker from obtaining one elsewhere.
- Monitor the live endpoint. Alert when a served certificate has less than a third of its lifetime left, and alert again if it has already expired.
- Separate internal from public. Devices and services that cannot automate can use a private certificate authority, which is not bound by browser lifetime rules, instead of a public certificate renewed by hand.
- Rehearse a mass replacement. Once a year, revoke and reissue every certificate in one sitting. If that takes more than an afternoon, the automation has gaps.
The Bottom Line
The 47 day certificate sounds like an inconvenience imposed by browser vendors, but it mostly exposes something that was already true: any certificate still renewed by a person reading a reminder email is a scheduled outage waiting for a holiday weekend. The 100 day limit arrives in March 2027. That is enough time to find every certificate, automate the ones that can be automated and redesign the ones that cannot, but not enough to keep putting it off.
