Certificates now last 200 days. Then 47.

In April 2025 the CA/Browser Forum voted to shorten the maximum life of a public TLS certificate. The first step already happened on March 15, 2026, when the limit dropped from 398 days to 200. Here is the rest of it:

At 47 days, each certificate needs at least eight renewals a year, more if you renew early, which you should. Nobody does that reliably. The math isn’t the hard part. The hard part is the certificate nobody knows about.

The yearly ritual is over

A 398-day certificate let teams get away with a calendar reminder and a wiki page. That stops working at 200 days and is clearly broken at 100. Renewal has to be something a machine does on its own, and something a human only hears about when it fails.

Find every certificate first

Automation only covers the certificates you point it at. Before changing any tooling, build the list:

• Pull everything from your certificate managers (ACM, Key Vault, cert-manager, whatever you run).
• Scan your listeners: load balancers, CDNs, API gateways, ingress controllers.
• Check Certificate Transparency logs for your domains. They show what was issued, including the ones someone bought on a corporate card in 2023.

Anything on that list that wasn’t issued by an automated process is your real backlog.

Prefer issuers that renew for you

Managed certificates with DNS validation renew without anyone touching them, as long as the validation record stays in place. ACM, Google-managed certificates, and cert-manager with an ACME issuer all work this way. Imported certificates do not renew themselves anywhere. Treat each one as a migration ticket.

The shorter validation reuse window matters too. At 10 days in 2029, the CA will re-check domain control almost every time it issues. DNS-based validation that lives in your infrastructure code holds up. Email-based validation to a shared mailbox does not.

Test the reload, not just the renewal

A renewed certificate on disk is not a renewed certificate in production. Plenty of services read their certificate once at startup and keep serving the old one until they restart. Shorter lifetimes surface this quickly. For each service, know how it picks up a new certificate, and test it before the old one expires.

Alert on expiry, not on renewal jobs

Monitor what clients actually see: connect over TLS, read the expiry date, and alert when it’s closer than it should be. With 47-day certificates renewing around day 30, anything under 14 days remaining means automation already failed once. Page on that. A green renewal job tells you a script ran. An expiry check tells you the site works.

None of this is new advice. The new part is that the deadline is printed in a ballot, and it’s getting closer every March.