Shorter TLS certificate lifetimes: what a small business needs to check

The TLS certificate on your website has an end date. For years, a publicly trusted TLS certificate could be valid for up to 398 days. For businesses using certificates near that limit, renewal was often an annual, manual task. Other issuers already used shorter lifetimes.

That limit has already changed. Certificates issued since 15 March 2026 can be valid for at most 200 days, and two more steps are scheduled. Nothing about this is an emergency, but it quietly changes what “we renew it every year” means.

What changed, and when

The rules for publicly trusted TLS certificates are set by the CA/Browser Forum, where certificate authorities and browser makers agree the requirements. In April 2025 it adopted a ballot (SC081v3) that introduced shorter lifetimes. The maximum validity depends on when a certificate is issued. An issuer may use a shorter lifetime; certificates issued by a private, internal certificate authority are outside this schedule:

• 1 September 2020–14 March 2026: at most 398 days.
• From 15 March 2026: at most 200 days.
• From 15 March 2027: at most 100 days.
• From 15 March 2029: at most 47 days.

The limit applies at the moment of issue. A certificate issued in February 2026 keeps the lifetime it was issued with; its replacement is the one that falls under the new rules.

Before issuing a certificate, the certificate authority has to confirm control of the domain. It may reuse that confirmation for a limited time: at most 200 days now, 100 days from 15 March 2027, and 10 days from 15 March 2029. By then a fresh domain check will be needed at many renewals. It is not required at every renewal if a previous check is still within the reuse period.

What it means in practice

Renewal becomes a regular event rather than an annual one. Since a certificate has to be replaced before it expires, the minimum rhythm is roughly twice a year today, about four times a year from 2027, and at least eight times a year from 2029.

If your hosting provider, website platform or content delivery network issues and renews your certificates automatically, little may change for you. Check that the automation adapts to the actual certificate lifetime rather than using a fixed renewal interval. Many providers use ACME (RFC 8555), a protocol designed for automated certificate management.

If a person renews a certificate by buying it, downloading it and installing it on a server, a previously annual task now needs to happen more often. As lifetimes shrink, manual renewal becomes more work and increases the risk of missed renewals. The same applies wherever you use a publicly trusted TLS certificate: a mail server, the policy host for MTA-STS, an internal tool exposed on the internet, or a subdomain someone set up years ago.

There is a quieter risk too. Automated renewal only works while the things it depends on stay in place. If the automation proves domain control with a DNS record or a file on the web server, moving DNS to a new provider or rebuilding the site can break it without any visible sign. The certificate keeps working until the day it doesn’t. This is the same kind of slow drift we describe in how email security goes stale: correct when it was set up, until something around it changed.

What to check

1. List the hostnames that carry a certificate. The website and its www variant, the shop, any subdomains, and anything mail-related such as an MTA-STS policy host.
2. Find out who renews each one. For every hostname, the answer should be a system (“the hosting platform renews it”), not a person or a calendar reminder.
3. Move manual renewals to automation. Ask your provider whether automatic issuance is available. For a server you run yourself, an ACME client can request and install certificates on a schedule.
4. Look at the current certificate’s dates. Your browser shows them in the site information next to the address bar. A certificate issued on or after 15 March 2026 may last at most 200 days, and many issuers use shorter lifetimes. Check the actual expiry date rather than assuming you have 200 days.
5. Keep an eye on what renewal depends on. DNS changes, a move to a new host and new CAA records (which state the certificate authorities allowed to issue for your domain) can all stop a renewal that used to work.

Check now that the next renewal will complete before expiry. The next reduction applies to certificates issued from 15 March 2027, so there is time to replace manual renewals with automation.

Where Merula fits

Merula checks the HTTPS certificate on the monitored domain name on a schedule. The check shows a warning when 30 or fewer calculated days remain and a critical finding when the certificate has expired. It can also flag potential conflicts between published CAA records and a certificate issuer Merula recognises. This is an indication of renewal risk, not a guarantee of what the next issuance will do. Merula does not automatically discover every subdomain and does not renew certificates for you.

Source: CA/Browser Forum, Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates ↗, version 2.3.0 (September 2026), sections 4.2.1 and 6.3.2; ballot SC081, adopted 11 April 2025. Also: the SC081v3 ballot ↗and Let’s Encrypt’s guidance on shorter lifetimes and renewal automation ↗.