The deadline this is about
In April 2025 the CA/Browser Forum passed Ballot SC-081v3, which shortens the maximum lifetime of publicly trusted TLS certificates in steps:
| Issued on or after | Maximum lifetime |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
A certificate renewed by software doesn't care. A certificate renewed by a person, with a purchase order, a CSR and an upload through a hosting panel, goes from a once-a-year chore to roughly eight times a year per host by 2029. The readiness score tells you how much of a domain is in the second group.
How the score is worked out
- We search Certificate Transparency logs for the domain, the same search as the subdomain certificate finder.
- We pick up to 25 hosts: the root domain and
wwwfirst, then hosts with a currently valid certificate, newest first. - Each host is resolved and checked on port 443. Hosts that point at private addresses are skipped, and so are hosts that no longer exist in DNS.
- Each certificate that answers gets a verdict. Ready: issued by an ACME certificate authority such as Let's Encrypt, ZeroSSL or Google Trust Services, so something renews it automatically. At risk: a lifetime over 100 days from a CA that is normally used by hand, which won't survive the 2027 step without changing how it's renewed.
- The score is the share of answering hosts that are ready.
Hosts serving an expired or untrusted certificate, and automated certificates whose renewal looks overdue, are listed as at risk too, whatever the score says. They are problems today, not in 2027.
What a good score looks like
100% means every host we could reach renews itself. That is the goal, and plenty of sites on managed hosting or a CDN are already there because the platform handles certificates. Below that, the at-risk list is the work: each entry needs either an ACME client on the server, the hosting provider's automatic certificate option switched on, or the site moved behind a CDN that issues certificates for you.
Automation isn't the end of the story. Automated renewals fail too, and quietly: Let's Encrypt stopped sending expiry reminder emails in June 2025, so a stalled ACME client now fails with no warning at all. Shorter lifetimes mean less slack when it happens. With a 47-day certificate renewed at a third of its life left, you have about two weeks between the missed renewal and the outage.
Why hosts usually end up at risk
- A paid certificate bought with the hosting plan. Some hosts sell a year-long certificate as an add-on even when a free automated one is available. Check the panel for an automatic SSL option before renewing it again.
- An extended validation or organisation certificate kept for the green bar that browsers no longer show. The legal-entity checks behind them can still be worth it for some businesses; the manual install usually isn't.
- A server nobody has logged in to for years. The certificate was uploaded by hand once, renewed by hand since, and the person who knew the process has left.
- Appliances and old control panels that only accept a pasted certificate. These need a replacement plan or a reverse proxy in front.
After the score
ExpiryOwl keeps this score per client and updates it as certificates change, and it flags a stalled renewal the day a certificate passes its normal renewal point rather than the week it expires. The free plan covers five domains, which is enough to watch the at-risk list you just made while you work through it.