# 47-day SSL certificates: the timeline and what to do now

In April 2025 the CA/Browser Forum, the body of certificate authorities and
browser makers that sets the rules for public TLS certificates, approved
ballot SC-081. It shortens the maximum lifetime of every public certificate
in three steps.

## The timeline

| Issued on or after | Maximum lifetime | Domain validation can be reused for |
|---|---|---|
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |

Certificates issued before each date keep their original lifetime, so the
first 200-day certificates started expiring in the autumn of 2026.

## What actually breaks

Renewing a web server is a solved problem: ACME clients such as certbot,
cert-manager, Caddy or your CDN renew automatically. Short lifetimes hurt
everywhere else:

- **Firewalls and VPN appliances** that need a certificate uploaded by hand.
- **Windows services** such as IIS, Remote Desktop Gateway and hybrid Exchange.
- **Load balancers and legacy hosting panels** where someone imports a file.
- **Automation that renews but never installs.** The ACME client gets a new
  certificate, but a reload hook fails, a container keeps the old file, or the
  certificate lands on one node of a cluster.

The last one is the sneaky one. Your renewal log says success while the server
keeps serving the old certificate until the day it expires.

## How to prepare

1. **Make an inventory.** Every certificate ever issued for your domain is
   public in Certificate Transparency logs. Start from that list, not from
   memory.
2. **Automate what you can,** and write down the manual steps for everything
   else (appliance, who owns it, how to install).
3. **Monitor what is served, not what was issued.** Check each host from the
   outside and compare the certificate it serves with the newest one in the
   logs. If a newer one exists and the old one is still served, the install
   failed.
4. **Alert relative to lifetime.** "30 days left" is a fine warning for a
   398-day certificate and pure noise for a 47-day one.

Shorter lifetimes mean more renewals that can be missed: see [Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed) and the runbooks for [FortiGate](/guides/fortigate-replace-ssl-certificate), [SonicWall](/guides/sonicwall-replace-ssl-certificate), [Sophos Firewall](/guides/sophos-firewall-replace-certificate), [IIS and Remote Desktop](/guides/iis-rds-replace-certificate) and [Exchange hybrid](/guides/exchange-hybrid-certificate-renewal). Using one wildcard on many devices multiplies the installs: see [wildcard SSL certificates](/guides/wildcard-ssl-certificates). MSPs: [SSL certificate monitoring for MSPs](/guides/ssl-certificate-monitoring-for-msps).

## Check your domain

The free scan reads the public certificate logs for your domain, connects to
each host, and flags certificates that were renewed but never installed.

---
Source: https://nameward.app/guides/47-day-ssl-certificates (updated 2026-10-29)