An expired digital certificate may seem like a minor issue until a website stops loading, an API can no longer communicate, a VPN starts reporting errors or a business application becomes inaccessible.
For years, many organisations have managed SSL/TLS certificates through manual reminders and periodic renewals. However, this approach is becoming increasingly difficult to sustain.
Since 15 March 2026, publicly trusted TLS certificates can have a maximum validity period of 200 days. From 15 March 2027, that limit will fall to 100 days and, from March 2029, it will reach just 47 days.
The message for businesses is clear: manually managing certificates will become increasingly risky. Inventory, monitoring and automated renewal are becoming part of operational continuity.
What changed for SSL/TLS certificates in 2026
The change forms part of the evolving requirements governing publicly trusted TLS certificates used to authenticate servers accessible over the Internet.
- Before 15 March 2026: maximum 398 days.
- From 15 March 2026 to 14 March 2027: maximum 200 days.
- From 15 March 2027 to 14 March 2029: maximum 100 days.
- From 15 March 2029: maximum 47 days.
These limits come from the CA/Browser Forum Baseline Requirements and apply to publicly trusted TLS certificates.
This distinction matters. A business may also use internal certificates issued by its own certification authority or private PKI. Those certificates are not necessarily subject to the same validity periods.
Although the term “SSL certificate” is still widely used, SSL itself is an outdated protocol. Modern environments use TLS, although SSL/TLS remains a common expression when referring to these certificates.
Why certificate lifetimes are becoming shorter
Reducing certificate lifetimes is not simply an administrative change. The aim is to reduce the period during which an incorrect, compromised or outdated certificate can remain valid.
A certificate represents a particular situation at the time it is issued: control of a domain has been demonstrated, specific information has been validated and a private key is associated with it.
The longer the certificate remains valid, the greater the possibility that this situation may change.
Shorter validity periods can limit the impact of issues such as:
- compromise of a private key;
- incorrectly issued certificates;
- changes in domain control;
- validation information becoming outdated;
- cryptographic or security changes requiring certificates to be replaced.
Shorter certificate lifetimes also encourage another major change: automation of the certificate lifecycle.
The real problem is not renewing one certificate, but knowing where all your certificates are
A small organisation may have only a handful of certificates. An infrastructure with multiple locations, cloud services, internal applications and Internet-facing systems can be very different.
Certificates may be installed across many different components:
- web servers
- business applications
- reverse proxies
- load balancers
- firewalls
- VPN portals
- mail servers
- APIs
- cloud services
- NAS and storage devices
- monitoring tools
- administration portals
- network devices
The problem begins when nobody has a complete inventory.
A certificate may have been installed months ago to meet a temporary requirement and then fallen outside the IT department’s usual procedures. When its expiry date arrives, the incident may appear with little warning.
This issue is closely related to managing the organisation’s external attack surface. Domains, subdomains, VPNs, applications and published services should all be part of an up-to-date inventory.
What can happen when a certificate expires
The consequences depend on the system where the certificate is installed. In some cases, users will simply see a warning. In others, the service may effectively become unusable.
A website or application becomes inaccessible
When a browser detects an expired certificate, it displays a security warning and may make normal access difficult or impossible.
If the portal is used by customers, suppliers or employees, a technical incident can quickly become an operational and reputational issue.
An API can no longer communicate with another system
Many business integrations use TLS to verify the identity of the systems with which they communicate.
If a certificate is no longer valid, an application may reject the connection. The result can be a failed integration, incomplete processes or data that stops synchronising.
A VPN or remote service begins reporting errors
Certificates are also part of many remote access and perimeter security solutions.
A poorly managed renewal can affect VPN portals, firewalls and other published services. Certificate management should therefore form part of a broader business perimeter security strategy.
The certificate is renewed but not installed correctly
Expiry is not the only risk. A certificate can be successfully renewed by the certification authority and still fail if it is not deployed correctly across every system that requires it.
Problems can also arise with the certificate chain, private key, permissions, certificate format or service configuration.
Manual renewal is becoming an unsustainable strategy
When certificates remained valid for more than a year, some manual procedures could be manageable. As certificate lifetimes progressively shorten, the margin for human error also decreases.
A certificate with a maximum validity of 100 days may require several renewals every year. With periods approaching 47 days, relying on one person and a calendar reminder becomes increasingly difficult to justify.
The problem also grows with the number of certificates.
A company may successfully manage nine renewals and forget the tenth. From a business continuity perspective, a single forgotten certificate protecting a critical service can be enough to cause an outage.
ACME and certificate lifecycle automation
One technology becoming increasingly important in this environment is ACME, which stands for Automated Certificate Management Environment.
ACME can automate processes including domain validation, certificate requests, issuance and subsequent renewal.
Instead of waiting for an administrator to notice that a certificate is approaching expiry, the system can automatically start the renewal process well in advance.
Automation does not mean certificates should be left unsupervised. It should be combined with monitoring, alerts and procedures capable of detecting failed renewals.
Automation does not remove the need for monitoring
An automated process can also fail. A DNS record may change, a firewall configuration may be modified, credentials may expire or the mechanism used to validate domain ownership may stop working.
A sound certificate strategy should therefore combine automation with active supervision.
At a minimum, the organisation should know:
- which certificates exist
- which domains and services they protect
- where they are installed
- which certification authority issued them
- when they expire
- how they are renewed
- who is responsible for the associated service
- whether the latest automated renewal completed successfully
A monitoring platform can also generate alerts before a certificate reaches a critical point.
This approach fits naturally with proactive IT maintenance and monitoring: detecting a problem before users are affected.
What businesses should review before March 2027
The next major change will arrive on 15 March 2027, when the maximum validity period for these certificates falls from 200 to 100 days.
Waiting until that date to review the infrastructure creates unnecessary risk.
- Create a certificate inventory. Identify public certificates, domains, subdomains and associated services.
- Find manual renewal processes. Identify systems that still depend on reminders or procedures carried out by an individual.
- Identify critical services. Prioritise customer portals, VPNs, APIs, business applications and essential services.
- Assess which renewals can be automated. Check support for ACME or other automated certificate management mechanisms.
- Monitor expiry dates. Do not rely exclusively on reminders sent by the certification authority.
- Monitor renewal results. Renewing a certificate does not guarantee that it has been successfully deployed.
- Document owners and procedures. Every critical certificate should have an associated service and a clearly identified owner.
Certificate management is becoming part of business continuity
For many years, digital certificates were treated as a technical item that only required attention when their expiry date approached.
The new environment requires a different approach.
When renewals occur several times a year, certificate lifecycle management needs to become part of normal infrastructure, monitoring and security processes.
The objective should no longer simply be to “renew the certificate on time”. Organisations need a system capable of knowing which certificates exist, renewing them where possible, verifying that the process succeeded and raising an alert when something goes wrong.
Frequently asked questions about SSL/TLS certificates
Shorter validity periods raise several common questions for businesses and technology managers.
How long does a publicly trusted TLS certificate currently last?
For publicly trusted certificates issued on or after 15 March 2026 and before 15 March 2027, the maximum validity period is 200 days. From 15 March 2027 it will fall to 100 days and in March 2029 it will fall again to 47 days.
Do these limits also apply to internal certificates?
Not necessarily. The CA/Browser Forum changes concern publicly trusted TLS certificates. A private PKI used exclusively within an organisation may apply different certificate lifetime policies.
Is using ACME mandatory?
No. ACME is one of the most widely adopted mechanisms for automating certificate management, but other platforms and solutions are available. The important objective is to reduce dependence on manual processes.
What happens if automatic certificate renewal fails?
This is why automation must be accompanied by monitoring. The system should generate an alert if a renewal fails or if a certificate continues approaching its expiry date.
How far in advance should certificate expiry be monitored?
There is no single threshold that suits every infrastructure. A better approach is to configure several staged alerts and use stricter thresholds for critical services, ensuring that the first warning does not arrive when only a few days remain.
Do you know where every certificate in your infrastructure is?
The progressive reduction in TLS certificate lifetimes is making certificate management increasingly dynamic. Organisations that still rely on manual renewal should review their inventory, monitoring mechanisms and automation options now.
At Inmove IT Solutions, we can help you review how certificates are managed across your infrastructure, identify manual dependencies and integrate certificate monitoring into a broader systems, communications and cybersecurity strategy.
A forgotten certificate renewal should not be the cause of a service outage.
Contact Inmove IT Solutions and we will help you design a more controlled, automated certificate management process prepared for shorter renewal cycles.
