In April 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public TLS certificates, approved ballot SC-081. It shortens the maximum lifetime of every public certificate in three steps.
The timeline
| Issued on or after | Maximum lifetime | Domain validation can be reused for |
|---|---|---|
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
Certificates issued before each date keep their original lifetime, so the first 200-day certificates started expiring in the autumn of 2026.
What actually breaks
Renewing a web server is a solved problem: ACME clients such as certbot, cert-manager, Caddy or your CDN renew automatically. Short lifetimes hurt everywhere else:
- Firewalls and VPN appliances that need a certificate uploaded by hand.
- Windows services such as IIS, Remote Desktop Gateway and hybrid Exchange.
- Load balancers and legacy hosting panels where someone imports a file.
- Automation that renews but never installs. The ACME client gets a new certificate, but a reload hook fails, a container keeps the old file, or the certificate lands on one node of a cluster.
The last one is the sneaky one. Your renewal log says success while the server keeps serving the old certificate until the day it expires.
How to prepare
- Make an inventory. Every certificate ever issued for your domain is public in Certificate Transparency logs. Start from that list, not from memory.
- Automate what you can, and write down the manual steps for everything else (appliance, who owns it, how to install).
- Monitor what is served, not what was issued. Check each host from the outside and compare the certificate it serves with the newest one in the logs. If a newer one exists and the old one is still served, the install failed.
- Alert relative to lifetime. "30 days left" is a fine warning for a 398-day certificate and pure noise for a 47-day one.
Shorter lifetimes mean more renewals that can be missed: see Certificate renewed but not installed and the runbooks for FortiGate, SonicWall, Sophos Firewall, IIS and Remote Desktop and Exchange hybrid. Using one wildcard on many devices multiplies the installs: see wildcard SSL certificates. MSPs: SSL certificate monitoring for MSPs.
Check your domain
The free scan reads the public certificate logs for your domain, connects to each host, and flags certificates that were renewed but never installed.