Ever shorter TLS certificates: 100 days from March 2027, what to prepare now
Since March 2026 an HTTPS certificate can last at most 200 days, from 15 March 2027 it drops to 100 and in 2029 to 47. Let's Encrypt moves to 64 days on 10 February 2027. Why manual renewal no longer works and what to check on websites, email and servers.
The padlock in the browser bar depends on a TLS certificate with an expiry date. For years it was enough to renew it once a year, often by hand. That habit is ending: industry rules are reducing the maximum certificate lifetime step by step, and the first effects are already visible this autumn.
For an SME the risk is not an attack but a service that stops working: a website showing a security warning, a mailbox that cannot connect, a contact form customers do not dare to fill in. Below are the verified dates and a checklist.
The dates to know
In April 2025 the CA/Browser Forum, the body in which certificate authorities and browser makers set common rules, adopted ballot SC-081v3. It sets this reduction of the maximum lifetime of public TLS certificates:
- until 14 March 2026: 398 days;
- from 15 March 2026: 200 days;
- from 15 March 2027: 100 days;
- from 15 March 2029: 47 days.
The dates apply to certificates issued from that day: a certificate already issued stays valid until it expires. The period during which an authority may reuse an earlier domain validation is also shrinking; from 2029 it will be 10 days. Some authorities apply limits one day shorter: DigiCert, for example, has issued at most 199 days since 24 February 2026.
A certificate issued on 15 March 2026 with the maximum lifetime expires at the beginning of October 2026. Anyone who renewed a paid certificate by hand in the spring is therefore facing the first half-yearly renewal in these weeks.
Let's Encrypt: 64 days from 10 February 2027
Many websites use free Let's Encrypt certificates, valid for 90 days so far. On 7 October 2026 Let's Encrypt confirmed that from 10 February 2027 it will issue 64-day certificates by default; this lifetime has been active in the staging environment since 14 October 2026. In 2028 it will move to 45 days, as set out in the timeline published in December 2025. The optional tlsserver profile has been issuing 45-day certificates since May 2026.
Let's Encrypt points out two practical matters. First, if the program that renews certificates (the ACME client) supports ARI (ACME Renewal Information), the authority itself tells it when to renew. Second, anyone who set renewal at a fixed number of days before expiry, for example 60, 80 or 83, should switch to renewing at about two thirds of the lifetime. Note also that since 4 June 2025 Let's Encrypt no longer sends expiry warning emails: if nobody is checking, the first alert may come from a customer.
Where certificates sit in an SME
The website is the most visible case, but not the only one. A public TLS certificate may also serve:
- mail servers (incoming and outgoing), webmail and shared calendars;
- business software, CRMs and customer portals reachable from the internet;
- remote access, firewalls, NAS devices and file sharing tools;
- APIs used by apps, online shops or payment providers;
- forgotten subdomains: old landing pages, test environments, past campaigns.
The reduction concerns certificates issued by public authorities and trusted by browsers. Certificates from an internal PKI follow the company's own rules, but they expire too and are worth adding to the same inventory.
What to check now
- Inventory. List domains and subdomains with a certificate, who issued it, when it expires and on which systems it is installed.
- Responsibility. For each certificate, who renews it: the hosting provider, the agency, the software supplier or an employee. Ask in writing if it is unclear.
- End-to-end automation. Renewal must be automatic all the way: issuance, installation on the server and restart or reload of the service. A new certificate left in a folder does not help.
- Intervals. Check that renewal is not tied to a fixed number of days designed for 90-day certificates, and use ARI where the client supports it.
- Paid certificates. With a multi-year subscription the certificate must still be reissued and installed at every expiry. Ask the provider whether it offers automatic renewal via ACME.
- Independent monitoring. An external check that warns in good time when a certificate is close to expiry or was not renewed, sent to people who actually read the alerts.
- Test before 2027. Let's Encrypt users can already try 64-day certificates in the staging environment.
Why this is also a security matter
A shorter lifetime limits how long a compromised or misissued certificate remains usable; that is the reason given by Let's Encrypt and the CA/Browser Forum. There is also a less obvious effect: when a website often shows certificate warnings, customers and staff get used to ignoring them, and it becomes harder to recognise a warning that points to a real problem.
For anyone collecting personal data through forms, customer areas or email, the Federal Act on Data Protection (art. 8 FADP) requires appropriate technical and organisational measures for data security. An encrypted connection that works without interruption is part of that. An expired certificate is not in itself a cyberattack, but renewal is best treated like other security tasks, with an owner and a check.
Update on the PHP flaws
The two PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, reported by the NCSC on 21 October 2026 and covered in our article of 22 October, are now actively exploited: on 26 October 2026 the US agency CISA added them to its catalogue of exploited vulnerabilities, as stated in its updated alert. Anyone who has not yet installed PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the equivalent fix from their provider, should do so without waiting and then check systems for anomalies.
Frequently asked questions
Will my current certificate stop working on 15 March 2027?
No. It remains valid until it expires. From that date only the maximum lifetime of newly issued or renewed certificates changes.
I use Let's Encrypt with automatic renewal: do I need to do anything?
Usually not, according to Let's Encrypt. You should still check that renewal is not set to a fixed interval, that the service is reloaded after renewal and that someone receives an alert if renewal fails.
My website is managed by the hosting provider: is this my problem?
For the website, often not. But email, business software, NAS or remote access may have certificates managed by other providers, or by nobody. It is worth asking each of them how renewal works.
Should I buy a 200-day certificate now?
It postpones the problem by a few months; it does not solve it. With 100 days in 2027 and 47 in 2029, automation is the practical way forward.
Our approach
ElaraTeq Sagl develops and runs websites and applications for SMEs and public bodies in Ticino, with hosting in Switzerland and automatic certificate renewal. We can inventory your certificates, set up renewal and monitoring, and review systems managed by third parties. For ongoing maintenance there is the service presented in the article on Orbit; for WordPress websites see also the October checks. For a review you can contact us.
Sources
- CA/Browser Forum, Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods, April 2025
- DigiCert, Moving to 199-day validity for public TLS certificates
- Let's Encrypt, 64-Day Certificate Lifetimes Coming Feb 2027, 7 October 2026; Decreasing Certificate Lifetimes to 45 Days, 2 December 2025; Profiles; Ending Support for Expiration Notification Emails, 22 January 2025
- Fedlex, Federal Act on Data Protection (FADP), SR 235.1, art. 8
- NCSC, Critical vulnerabilities in PHP: Install security updates immediately, 21 October 2026
- CISA, Critical Vulnerabilities in PHP Require Immediate Patching, updated 26 October 2026
