Certificates are getting shorter. Outages don't have to.
By 2029 every public certificate renews roughly every month and a half. Here's the timeline and how to stay calm through it.
The schedule
Source: CA/B Forum ballot SC-081v3.
| From | Maximum validity |
|---|---|
| Before 15 Mar 2026 | 398 days max |
| From 15 Mar 2026 | 200 days (in force now) |
| From 15 Mar 2027 | 100 days |
| From 15 Mar 2029 | 47 days, and domain validation can only be reused for 10 days |
What it means for you
A one-year cert meant one renewal a year. At 47 days it's around eight. Manual renewal stops being realistic. Automation becomes the only option, and automation needs a second pair of eyes.
The checklist
- Automate renewal everywhere.
- Inventory every hostname.
- Monitor the result, not just the job.
- Make sure alerts reach a person.
Where we fit
SSL Clock watches every certificate from the outside and warns you when a renewal didn't happen, with the reason and the fix.
Check a site with the free SSL checker or see pricing. Read the 47-day certificate timeline and Let's Encrypt expiry emails.
FAQ
Does this affect Let's Encrypt?
Let's Encrypt certs already last 90 days, which is under the 2026 and 2027 caps.
Internal/private CAs?
The rules cover publicly trusted TLS certs.