The SSL certificate lifecycle in the 47-day era: issue, validate, deploy, monitor
Updated 21 October 2026
CA/Browser Forum Ballot SC-081v3 sets maximum public TLS certificate validity to 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Domain-validation reuse periods shrink on a similar schedule, reaching 10 days in 2029. Certificates already issued stay valid until their own expiry.
1. Issue
Use ACME (RFC 8555), the protocol used by Let's Encrypt and many commercial CAs, so certificates can be requested without a human. Manual CSR-and-email workflows don't scale to several renewals a year.
2. Validate
With shorter reuse periods, domain control has to be proven more often. HTTP-01 needs the site reachable on port 80; DNS-01 needs API access to the DNS provider. Decide per client which one works.
3. Deploy
The most common failure isn't issuance, it's deployment: a new certificate exists, but the load balancer, CDN, mail server or appliance is still serving the old one.
4. Monitor what's served
Certificate Transparency logs (RFC 9162) show every publicly trusted certificate issued for a domain, which helps find forgotten hosts. But a CT entry doesn't prove what a server presents. Connect to each host and port and read the served certificate's expiry.
5. Alert and report
Alert at 30, 14 and 3 days. With 47-day certificates, an ACME client that renews at day 30 leaves about two weeks of margin, so a stuck renewal must surface fast.
What changes for agencies
| Max lifetime | Renewals per host per year (approx.) |
|---|---|
| 398 days (before 2026) | 1 |
| 200 days | 2 |
| 100 days | 4 |
| 47 days | 8 |
Multiply by 50 client sites, each with www, mail and API hosts, and manual tracking stops working.
Look up 25 domains free Check a certificate
Sources
- CA/Browser Forum Ballot SC-081v3 (checked 21 Oct 2026)
- RFC 8555: Automatic Certificate Management Environment (ACME) (checked 21 Oct 2026)
- Let's Encrypt: Getting started (checked 21 Oct 2026)
- RFC 9162: Certificate Transparency 2.0 (checked 21 Oct 2026)
Stop tracking renewals in a spreadsheet
RenewRoster tracks every client's domains and certificates, reminds clients under your brand and gives you a monthly renewals report.
The online waitlist opens with the app. To join the beta now, email [email protected] with your agency name and roughly how many domains you manage.
Founding agencies get early access and 50% off their first year. No spam; one confirmation email.