SSL certificates are moving to 47 days. Here's what agencies need to do
Updated 21 October 2026
In 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public TLS certificates, approved a phased cut in maximum certificate lifetimes (ballot SC-081).
The timeline
| Issued on or after | Maximum lifetime |
|---|---|
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
The period for reusing domain-validation results is shrinking on a similar schedule, so certificates also have to be re-validated more often.
Which client sites are at risk
- Manually installed certificates. Anything someone uploads by hand once a year will now need doing several times a year.
- Paid OV/EV certificates bought from a reseller and installed through a hosting control panel.
- Appliances, load balancers and CDNs that can't use ACME (the protocol behind Let's Encrypt) for automatic renewal.
- Mail servers and other non-web ports (465, 993, 995) that are easy to forget.
Agency checklist
- Find every certificate: website, www, mail, API and staging hosts.
- Mark which ones renew automatically (ACME) and which don't.
- Move what you can to automated renewal.
- Monitor the certificate each host actually serves, not just the one you think you installed.
- Alert at 30, 14 and 3 days.
Use Certificate Transparency to find forgotten certificates
Every publicly trusted certificate is logged in public Certificate Transparency (CT) logs. Searching them for a client's domain shows hosts you may have forgotten. A CT entry only proves a certificate was issued, though, not that it's the one being served. That's why RenewRoster connects to each host and reads the served certificate.
Stop tracking renewals in a spreadsheet
RenewRoster tracks every client's domains and certificates, reminds clients under your brand and gives you a monthly renewals report.
The online waitlist opens with the app. To join the beta now, email [email protected] with your agency name and roughly how many domains you manage.
Founding agencies get early access and 50% off their first year. No spam; one confirmation email.