Introduction

The small padlock in a browser’s address bar tells visitors that their connection to your website is secure. Behind it sits an SSL certificate, more accurately called a TLS certificate. It proves that the website really belongs to the domain shown and encrypts everything that passes between the visitor and the server, from contact form messages to passwords and payment details.

For years, many businesses bought a certificate, installed it and forgot about it for a year or more. That approach is ending. The organisations that set the rules for public certificates have agreed to shorten certificate lifespans in stages. Since 15 March 2026, a new public certificate can be valid for no more than 200 days. From March 2027 the limit falls to 100 days, and from March 2029 to just 47 days.

For websites that already renew automatically, little will change. For websites, servers and devices that still rely on someone remembering to renew a certificate by hand, the risk of an expired certificate, and a frightening browser warning, rises sharply. This article explains what is changing, why, what it means for your business and how to prepare.

What an SSL/TLS certificate does

When a visitor opens a website over HTTPS, their browser and the server agree on encryption before any page content is sent. The server presents its certificate, which is issued by a certificate authority (CA) that browsers trust. The browser checks that:

• The certificate was issued by a trusted certificate authority.
• It covers the domain the visitor is trying to reach.
• It is within its validity period, neither expired nor not yet valid.
• It has not been revoked.

If any check fails, the browser shows a full-page warning telling the visitor the connection is not private. Most visitors leave immediately. For an online store, that means lost sales; for any business, it means lost trust.

HTTPS is now a basic expectation. Browsers label sites without it as “not secure”, and HTTPS is a long-standing part of the signals Google uses for page experience.

What is changing, and when

The rules for public certificates are set by the CA/Browser Forum, a group of certificate authorities and browser makers including Apple, Google, Microsoft and Mozilla. In April 2025, the forum approved Ballot SC-081v3, which reduces the maximum validity of public TLS certificates in stages:

Two changes are happening together:

• Shorter certificate lifespans. Certificates must be replaced more often: roughly twice a year from 2026, about four times a year from 2027 and around eight times a year from 2029.
• Shorter validation reuse. Before issuing a certificate, the CA must confirm that you control the domain. The period for which that check can be reused is also shrinking, to just 10 days by 2029. In practice, domain control will need to be confirmed almost every time a certificate is issued.

Certificates already issued before each date remain valid until they expire. The changes apply to new certificates, including renewals.

Why the industry is making certificates shorter

Revocation does not work well

If a certificate’s private key is stolen or the certificate was issued wrongly, it should be revoked. In practice, browsers do not check revocation reliably, so a compromised certificate can remain usable until it expires. Shorter lifespans limit how long a compromised certificate can be misused.

Information goes out of date

A certificate confirms who controls a domain at the time it was checked. Domains change hands, companies change names and servers change. Shorter certificates and more frequent validation keep that information current.

Preparing for new cryptography

Security standards evolve, and the industry is preparing for new encryption methods designed to resist future quantum computers. When everyone renews frequently and automatically, new algorithms and settings can be rolled out across the internet far faster.

Encouraging automation

The underlying aim is to make manual certificate management a thing of the past. Automated renewal removes human error, the cause of many outages when someone forgets a renewal date.

Who is affected

Every organisation that uses public TLS certificates is affected, but the impact depends on how certificates are managed today.

Websites with automatic renewal

Many hosting platforms already issue and renew free certificates automatically using the ACME protocol, the standard used by services such as Let’s Encrypt. These certificates already last 90 days or less and renew well before they expire. For these websites, the change makes little practical difference, as long as the automation keeps working.

Websites with manually installed certificates

Businesses that buy a paid certificate each year and install it by hand face the biggest change. Under the new limits, that annual task becomes a twice-yearly task, then a quarterly one, then almost monthly. Each manual renewal is a chance to forget, make a mistake or install the certificate on one server but not another.

Other systems that use certificates

Websites are not the only systems with certificates. Others include:

• Email servers (for secure mail connections).
• Control panels and webmail.
• VPN gateways and firewalls.
• Load balancers and content delivery networks.
• APIs and integrations with partners.
• Network devices, printers and storage systems with web interfaces, if they use public certificates.

Any of these with a manually managed public certificate needs a plan.

Expired certificates in practice

When a certificate expires, the problem appears suddenly. Visitors see warnings, apps that connect to an API fail, email clients complain and payment or courier integrations may stop working. Because certificates expire at a precise moment, the failure often happens at night or at a weekend.

Paid certificates, free certificates and validation levels

Certificates differ in how thoroughly the certificate authority checks the applicant:

• Domain Validated (DV): confirms control of the domain. This is what most websites use, including free certificates.
• Organisation Validated (OV): also confirms the organisation’s details, which appear in the certificate.
• Extended Validation (EV): a stricter check of the organisation. Browsers no longer show EV certificates very differently from others in the address bar.

All three provide the same strength of encryption. The choice between free and paid certificates depends on whether you need organisation details in the certificate, particular warranties or support, or certificate types that a free service does not offer. Whatever the type, the new validity limits apply to all public TLS certificates, so automation matters for paid certificates too.

Some certificates cover several names, such as a wildcard certificate for every subdomain of a domain or a multi-domain certificate for several domains. These must be renewed on the same shorter schedule and installed everywhere they are used.

How to prepare: a practical plan

1. Make an inventory

List every public certificate your business uses: websites, subdomains, email, control panels, VPNs, APIs and devices. Record who issued each one, when it expires, where it is installed and how it is renewed. Many businesses discover forgotten certificates during this step.

2. Automate renewals wherever possible

Use hosting and certificate services that support automatic issuance and renewal through ACME or the provider’s own automation. Automatic renewal should also install the new certificate and reload the server, so no manual step remains.

3. Make domain validation automatic

Since validation reuse is shrinking to 10 days by 2029, the domain control check should be automated. Common methods include a file placed on the website or a DNS record created automatically. If your DNS is managed by a different provider, check that the certificate automation can create the required records.

4. Monitor expiry dates independently

Automation can fail silently: an expired payment card, a changed DNS setting, a firewall blocking validation or a server moved without its renewal settings. Independent monitoring of certificate expiry dates, with alerts well before expiry, catches these failures. Do not rely on reminder emails from the certificate authority; some services, including Let’s Encrypt, have stopped sending them.

5. Plan for systems that cannot automate

Some older devices and software cannot renew certificates automatically. For these, consider placing them behind a proxy or load balancer that manages certificates automatically, upgrading or replacing them, or limiting them to internal use with private certificates where appropriate.

6. Review contracts and costs

If you buy paid certificates, ask your provider how pricing works under the new rules. Many providers now sell subscriptions that cover a year or more of automatically renewed certificates, rather than a single certificate.

7. Assign responsibility

Someone must own certificate management, whether an internal team or your hosting provider. Write down who is responsible for each certificate and who receives the alerts.

HTTPS good practice beyond the certificate

A valid certificate is the starting point, not the whole job. A well-configured HTTPS website also:

• Redirects every HTTP address to HTTPS, using permanent (301) redirects, so visitors and search engines always reach the secure version.
• Has no mixed content. Images, scripts and style sheets must also load over HTTPS; otherwise browsers may block them or show warnings.
• Uses current TLS versions. TLS 1.2 and TLS 1.3 should be enabled, and older versions disabled.
• Uses HTTP Strict Transport Security (HSTS) where appropriate, telling browsers to always use HTTPS for the domain.
• Covers every name visitors use, including both the www and non-www versions and any subdomains.
• Protects the private key. The key that matches the certificate must stay on the server, with restricted access, and should be replaced if there is any chance it has been exposed.

Free online tools can test a website’s HTTPS configuration and highlight weak settings.

A timeline of what to do

Questions to ask your hosting provider or IT team

• Which of our certificates renew automatically, and which are renewed by hand?
• Does renewal also install the new certificate and reload the server?
• How is domain control validated, and will that still work when validation must be repeated every 10 days?
• Who receives an alert if a renewal fails, and how long before expiry?
• Are there devices or older systems that cannot renew automatically, and what is the plan for them?
• How will the cost of any paid certificates change?

What this means for online stores and portals

For websites that take payments, logins or personal data, an expired or misconfigured certificate is more than an embarrassment. Customers cannot complete a purchase while the browser warns them away, payment gateways may refuse to send confirmations to a server with an invalid certificate, and mobile apps that connect to the site’s API may stop working entirely. These failures are often harder to spot than a warning on the home page, because they happen in the background.

Stores and portals should therefore monitor every address that other systems connect to, not just the main website: the API endpoint, the payment callback address, the customer portal and any subdomains used by apps. Each should be included in the certificate inventory and in expiry monitoring. When a certificate is renewed, test a payment and an app login as part of the routine checks, at least until you are confident the automation covers every address.

What we do for our hosting clients

For websites hosted with Dsigngo Group:

• Free SSL certificates are issued and renewed automatically for your domain and subdomains, with the new certificate installed without any action from you.
• Expiry monitoring checks certificates independently and alerts our team before any certificate gets close to expiry.
• Paid certificates, where a client needs one, are managed and installed by our team on the shorter schedule.
• Email, webmail and control panel connections on our servers are covered by automatically renewed certificates.

For clients with servers, firewalls and devices supported by Raiden (Pvt) Ltd, we can review all the certificates in use and set up automation or monitoring for each one. Free, automatically renewed certificates and expiry monitoring are included in every hosting plan. Paid organisation-validated (OV) and extended-validation (EV) certificates are available on request, and we install and renew them for you.

Common questions from business owners

Will my website stop working in March 2026?

No. Existing certificates remain valid until they expire. The change affects new certificates and renewals issued after each date. If your certificates renew automatically, you are unlikely to notice any difference.

Do I have to pay more for certificates now?

Free, automatically renewed certificates are not affected by cost. If you buy paid certificates, the shorter lifespan means more frequent renewals, and providers are adjusting their pricing and moving to subscriptions. Ask your provider how the change affects you.

Is a free certificate as secure as a paid one?

Free and paid DV certificates use the same encryption. Paid certificates may add organisation validation, warranties or support. For most small business websites, an automatically renewed free certificate is entirely suitable.

What happens if a certificate expires?

Visitors see a full-page browser warning, and most will leave. Integrations and apps that connect to the server may also fail. The fix is to issue and install a new certificate, which takes minutes with automation, but the damage to trust can last longer.

Does HTTPS help my Google ranking?

HTTPS has long been part of the page experience signals Google uses, and browsers warn visitors about non-secure pages. More importantly, it protects your visitors’ data and their trust.

Illustrative example

The following example is illustrative and does not describe a real client.

A logistics company had a customer tracking portal, a public website and a VPN for staff working from branches. The website used an automatically renewed free certificate. The tracking portal used a paid OV certificate bought each year and installed by hand on two servers behind a load balancer. The VPN used another certificate that an IT contractor had installed three years earlier.

When the company reviewed its certificates ahead of the 200-day limit, it found that the portal’s certificate had been renewed on one server but not the other the previous year, causing intermittent warnings that customers had reported but nobody had traced. The VPN certificate was due to expire within weeks.

The portal certificate was moved to the load balancer, with automatic renewal through the certificate provider’s ACME service. The VPN was updated to a version that supports automated renewal. Independent expiry monitoring was set up for all three, with alerts to the IT team and to the hosting provider. When the limit falls to 100 days and then 47, nothing will need to change.

Conclusion

Shorter certificate lifespans are good for security, but they turn certificate renewal from an occasional task into a frequent one: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029, with domain validation checks becoming almost constant. The answer is automation: issue, validate, renew and install certificates automatically, monitor expiry dates independently and give someone clear responsibility.

If your website is hosted with us, your certificates are already handled. If you are not sure how your certificates are managed, we can review them for you.

Check My SSL Certificates

Sources

• CA/Browser Forum, Ballot SC-081v3: Introduce schedule of reducing validity and data reuse periods: https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/
• DNSimple, SSL certificate validity changes (2026–2029): https://support.dnsimple.com/articles/announcement-ssl-certificate-validity-changes/
• Sectigo, SSL/TLS certificate lifespans are decreasing to 200 days: https://sectigostore.com/blog/ssl-tls-certificate-lifespans-are-decreasing-to-200-days/
• IETF RFC 8555, Automatic Certificate Management Environment (ACME): https://www.rfc-editor.org/rfc/rfc8555
• Let’s Encrypt, Ending expiration notification emails: https://letsencrypt.org/2025/01/22/ending-expiration-emails/
• Google Search Central, Page experience (HTTPS): https://developers.google.com/search/docs/appearance/page-experience