SSL certificate validity is the period a certificate is trusted, between its "not before" and "not after" dates. In April 2025 the CA/Browser Forum approved a schedule that cuts the maximum lifetime of public TLS certificates from 398 days to just 47 days by 2029. Manual renewal is becoming impractical, so automation is now the default for every website.
Before you start
- A list of where your certificates are installed: hosting, CDN, mail servers, load balancers, devices.
- Know which ones renew automatically and which are installed by hand.
The new certificate lifetime schedule
| Certificates issued from | Maximum validity | Domain validation reuse |
|---|---|---|
| Before 15 March 2026 | 398 days | 398 days |
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
The reuse column is how long a CA may rely on an earlier domain validation before checking again. Organisation details for OV and EV certificates can be reused for up to 398 days.
Why certificate lifetimes are getting shorter
- Less damage from compromised keys: a stolen key is useful for weeks, not a year.
- Revocation does not work well: browsers often do not check revocation reliably, so short lifetimes act as automatic expiry.
- Fresher validation: when a domain changes owner, old certificates stop working sooner.
- Crypto agility: the industry can move to new algorithms faster when certificates rotate often.
What it means for website owners
If your certificates already renew automatically, very little changes. Free certificates from Let's Encrypt and AutoSSL already last 90 days or less and renew well before expiry. The pain is for manually installed paid certificates: by 2029 they would need replacing about eight times a year.
How to automate SSL renewal
- cPanel hosting: AutoSSL issues and renews certificates for every domain on the account. On MdmHost it is enabled by default. Check status in cPanel → Security → SSL/TLS Status.
- VPS or own server: use an ACME client such as Certbot, acme.sh or the built-in ACME support in your web server, with a scheduled renewal job.
- Paid OV/EV certificates: ask your CA for ACME support or a certificate management tool; many now offer ACME with external account binding.
- CDNs and load balancers: use the provider's managed certificates where possible.
Tip: Add certificate expiry checks to your uptime monitoring so you hear about a failed renewal days before visitors see a warning.
Troubleshooting failed automatic renewals
- Domain no longer points to the server: validation fails. Remove unused domains or fix DNS.
- HTTP validation blocked: redirects, a firewall or a maintenance plugin block
/.well-known/. - CAA record restricts CAs: if your DNS has a CAA record, it must allow the CA your host uses.
- Rate limits: repeated failed attempts can hit CA limits; fix the cause and wait before retrying.
Frequently asked questions
Can I still buy a multi-year SSL certificate?
You can buy a multi-year subscription, but the CA will issue several shorter certificates during that time. Each must be reinstalled or automated.
Does the change affect free SSL from AutoSSL?
Hardly at all. AutoSSL certificates are already short-lived and renewed automatically.
Do private or internal certificates follow these rules?
No. The rules apply to publicly trusted certificates. Private CAs set their own policies.