Guide · Certificates
47-day SSL certificates: the schedule and what agencies should do
Checked against sources on 2026-09-25 · 5 min read
In April 2025 the CA/Browser Forum, the group of certificate authorities and browser makers that writes the rules for public TLS certificates, passed Ballot SC-081v3. It cuts the maximum lifetime of a publicly trusted certificate in three steps, from 398 days down to 47 days in March 2029. It also shortens how long a CA may reuse a domain check before it has to validate your domain again.
The vote was not close. Certificate issuers voted 25 in favour, none against, with 5 abstaining. All 4 certificate consumers (the browser makers) voted yes. So this is happening, and the first step already has: since 15 March 2026 no public CA may issue a certificate valid for more than 200 days.
The schedule
| Issued on or after | Max certificate lifetime | Max domain validation reuse |
|---|---|---|
| Before 15 Mar 2026 | 398 days | 398 days |
| 15 Mar 2026 | 200 days | 200 days |
| 15 Mar 2027 | 100 days | 100 days |
| 15 Mar 2029 | 47 days | 10 days |
The dates come from the Baseline Requirements, the document every public CA is audited against. The limits apply to when a certificate is issued. A certificate issued the day before a cutoff keeps its longer lifetime until its own expiry date. The ballot also cuts how long a CA may reuse validated organisation details (the company information in OV and EV certificates) from 825 days to 398.
What the shorter lifetimes change
A certificate that lasts 398 days gets renewed once a year. Someone puts it in a calendar, someone else forgets, and once a year you find out which. At 200 days that becomes roughly twice a year per site. At 100 days it is about four times. At 47 days it is close to eight renewals a year, and 47 is the ceiling, so in practice you renew sooner than that.
The domain validation change matters just as much. For now a CA can reuse a successful domain check for up to 200 days, so many renewals skip the DNS or HTTP challenge entirely. From March 2029 that reuse window is 10 days. Nearly every renewal will need a fresh domain check, which means the DNS record or web path your validation depends on has to work every time, not just the first time somebody set it up.
What this means for an agency
For one site, a manual renewal every six or seven weeks is a chore. For an agency looking after 60 client sites it is about 480 renewals a year, close to two every working day. Done by hand, that is a part-time job that fails without making a sound.
Manual certificates tend to hide in the same places:
- Hosting accounts where someone uploaded a paid certificate by hand a few years ago.
- Load balancers, CDNs and firewalls that keep their own certificate store.
- Mail servers, VPN gateways and the client's old staging box.
- Subdomains a previous developer set up and nobody wrote down.
The first two usually move to automation without much fuss. The last one is the one that turns into a support ticket. You can list the subdomains that have ever had a public certificate with our subdomain certificate finder, which reads certificate transparency logs.
Paid certificates versus ACME automation
Paying for a certificate does not buy a longer lifetime. The limits apply to every publicly trusted CA, free or paid. What a paid certificate can still give you is organisation validation, support, a warranty, or a vendor contract your client insists on. Ask your vendor whether they offer ACME. If they do, you can keep the vendor and drop the manual steps.
ACME is the protocol Let's Encrypt and other CAs use for automated issuance. A client on the server (certbot, lego, Caddy, or your host's control panel) proves control of the domain, fetches the certificate and installs it, then does it again before the certificate runs out.
Let's Encrypt is moving faster than the Forum's schedule. Its lifetime announcement sets out three steps: an opt-in tlsserver profile issuing 45-day certificates from 13 May 2026, the default classic profile moving to 64-day certificates on 10 February 2027, and 45-day certificates by default from 16 February 2028. The same post warns that renewing at a hardcoded interval of 60 days will no longer be enough.
Automation that fails quietly
Automation moves the risk. It does not remove it. A renewal job can stop because a DNS API token expired, a firewall change blocked the HTTP challenge, a server migration left the cron job behind, or the new certificate landed on disk and the web server was never reloaded. None of these send you an email, and Let's Encrypt itself stopped sending expiry emails in June 2025.
So the check that matters is external: look at the certificate the site actually serves, from outside, and compare its dates with when it should have renewed. For ACME certificates that point is normally when a third of the lifetime is left, which is what Let's Encrypt recommends. Clients that support ACME Renewal Information get a suggested renewal window from the CA directly.
A practical checklist
- Make an inventory. List every hostname that serves HTTPS for each client, including www, mail, staging and API subdomains. Run the list through the bulk SSL checker to see the issuer and expiry of each.
- Mark each certificate as automated or manual. A certificate issued for close to a year and installed by hand is manual until proven otherwise. The 47-day readiness checker looks at one domain at a time for this.
- Move manual certificates to ACME wherever the host allows it. Where it does not (some managed platforms, some appliances), write down who renews each one and when.
- Make domain validation boring. Use DNS setups that survive being checked every time, such as stable CNAME delegation or API tokens that do not disappear with a staff member's account.
- Test renewals now, while the limit is 200 days, not in 2029. On certbot,
certbot renew --dry-runruns a renewal against the staging server without saving anything (certbot docs). - Monitor the served certificate from outside, and alert on "should have renewed by now", not only on "expires in 7 days".
- Tell your clients. A client who pays a registrar for a yearly certificate should hear from you before that invoice stops making sense.
Where we fit
ExpiryOwl checks every certificate every six hours and flags an ACME certificate as renewal overdue once it passes the point where it would normally have been renewed. The free plan covers 5 domains and needs no card. There is more on how the new schedule plays out for web design agencies on our agency page.