Certificates already expire in 200 days — and 47 is coming

Updated August 2026 · about a 5-minute read

If you still think of an SSL certificate as a once-a-year chore, that mental model quietly stopped being true this March. The maximum lifetime of a publicly trusted certificate is now 200 days, down from 398. It drops again in 2027, and by 2029 the ceiling is 47 days. This isn't a proposal or a maybe — the industry voted, unanimously, and the clock is already running.

Here's what's actually happening, why, and the one thing it changes for anyone who runs a website.

The real schedule

In April 2025 the CA/Browser Forum — the body where browser makers and certificate authorities set the rules that keep HTTPS trustworthy — passed a ballot (proposed by Apple, backed by Google) to shorten certificate lifetimes in steps. The vote was 29 in favour, none against. The steps:

The validation behind the certificate gets shorter too: the period you're allowed to reuse domain-control validation drops in the same steps, all the way to just 10 days by 2029. Translation: not only does the certificate expire faster, the proof that you own the domain has to be re-established faster as well.

Why they're doing this

Two reasons, and they're both reasonable. First, a shorter-lived certificate is a smaller blast radius: if a key is compromised or a certificate is mis-issued, it can only be abused until it expires, so 47 days beats 398. Second — and this is the real agenda — short lifetimes make manual renewal impossible, which forces everyone onto automation. At 47 days you'd be renewing roughly eight times a year. Nobody's putting that in a calendar.

The stated goal is "automate or die." Which is fine — until you remember that automation is exactly the thing that fails without telling anyone.

The catch nobody puts on the slide

Shorter certificates are sold as safer, and they are. But there's a second-order effect the announcements skip: every renewal is a chance to fail, and you just multiplied the number of renewals by eight.

Think about it. When a certificate renewed once a year, your auto-renewal had one job, once. Now that same job runs eight times a year — and each run depends on a cron that's still alive, a validation path that still resolves, an API token that hasn't expired, a server that wasn't rebuilt since last time. Any one of those breaking means the renewal silently stops, and now it stops eight times as often. Shorter lifetimes don't just reduce risk; they trade a rare, catastrophic failure for a frequent, quiet one.

I've written before about why auto-renewal fails silently and what to do when a certificate expires on you. Everything in those pieces gets more true as the numbers shrink. The failure mode isn't going away — it's getting more frequent.

What actually changes for you

Not much, if you do one thing: stop trusting the renewal to report on itself, and put an independent set of eyes on the live certificate. Something outside your infrastructure that looks at the real cert the world sees, every day, and tells you it's about to lapse while there's still time to fix the cron over coffee.

That was good advice at 398 days. At 200 it's important. At 47 it's the only thing standing between you and a red-screen outage several times a year. The certificate got shorter; the warning has to get louder.