In April 2025 the CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules for public TLS certificates, approved a schedule that shortens maximum certificate lifetimes in stages until 2029. The first step is already in force. For small businesses that still renew certificates by hand once a year, this changes what "looking after the website" means.
The schedule
| Certificates issued on or after | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
The same ballot also shortens how long a CA may reuse a previous check that the customer controls the domain, ending at 10 days in 2029. In practice: certificates will need to be renewed, and domain control re-proven, several times a year.
Why it is happening
- Revocation does not work well. When a certificate's key is exposed or it was issued by mistake, browsers cannot reliably learn that it was revoked. Shorter lifetimes limit how long a bad certificate stays usable.
- Information gets stale. Domains change hands. A short lifetime means the certificate reflects current ownership.
- Automation is now normal. Free, automated CAs and the ACME protocol made renewing every few weeks routine for most of the web.
What changes for a small business site
If the site is on a modern host, a website builder or behind Cloudflare, probably nothing: the platform already renews automatically, often every 90 days or less. The sites at risk are the ones where someone bought a certificate, installed it by hand and set a calendar reminder for next year:
- Self-managed servers and older shared hosting.
- Appliances and portals: firewalls, VPN gateways, NAS boxes, client portals, phone systems.
- Anything where the person who installed the certificate has left.
At 200 days that is two manual renewals a year; at 47 days it is about eight, which is not a realistic manual process.
Expiry reminders are also less reliable than they were: Let's Encrypt stopped sending expiration notification emails in June 2025, so "we'll get an email" is no longer a plan.
What MSPs should tell clients
- Find every certificate. Public certificate transparency logs list every certificate issued for a domain and its subdomains, which is a quick way to find forgotten hosts.
- Automate renewals with ACME wherever the platform supports it: built-in hosting features, Certbot or another ACME client, or the device vendor's automation.
- Monitor expiry for anything that cannot be automated yet, independently of the CA.
- Lock down issuance with a CAA record listing the CAs the client actually uses. See CAA records explained.
How Hookgap helps
Every report shows the certificate's issuer, issue and expiry dates, covered names, whether it is a wildcard and whether it looks automatically renewed (Hookgap treats a lifetime of 100 days or less as automated). Watched domains are rechecked weekly, and an alert fires when a certificate crosses 14 days from expiry, which makes a natural, helpful reason to contact a prospect. See follow-up triggers for MSP sales.
A browser warning is the most visible security problem a small business can have. It is also one of the easiest to prevent. For the rest of the website basics, read website security headers explained.
Frequently asked questions
What is the maximum SSL certificate lifetime in 2026?
Public TLS certificates issued on or after 15 March 2026 can be valid for at most 200 days, under the CA/Browser Forum Baseline Requirements.
When do certificates become 47 days?
From 15 March 2029. The limit steps down to 100 days on 15 March 2027 first.
Do I need to buy certificates more often?
Not necessarily. Paid certificates are often sold as multi-year subscriptions with reissues. The real change is that each certificate must be replaced more often, which only works reliably with automation.
Keep reading
Guide · 12 min read
Website security headers explained for small business sites
Each header in plain English, a safe starting value, how to add it on common hosts, and how to avoid breaking the site.
CAA record explained · 5 min read
CAA records explained: limit who can issue your SSL certificates
A small DNS record that tells certificate authorities who is allowed to issue for a domain, with examples and the one mistake to avoid.
MSP sales follow-up · 6 min read
Follow-up triggers for MSP sales: certificates, domains and DMARC changes
Replace "just checking in" with news. Six public events worth a follow-up, with a short message for each.