TLS certificate lifetimes are being cut, step by step, to 47 days. Certificates already expire unnoticed under today's rules — here is why that happens, what is changing, and how to build a safety net before renewal becomes a routine that runs every few weeks.
An expired certificate is one of the most visible failures a company can have. The site is up, the servers are healthy — and every visitor sees a full-screen browser warning telling them the connection is not safe. Most people leave. The engineering post-mortem usually ends with the same sentence: "we didn't know that certificate existed."
That problem is about to get more frequent, because the rules governing how long a certificate may live are changing dramatically.
Why do TLS certificates expire unnoticed?
Certificates usually expire unnoticed because nobody holds a complete inventory. A forgotten subdomain, a certificate managed by a supplier, or a service set up by someone who has since left the company all sit outside whatever spreadsheet or calendar the team relies on — until a browser warning announces the expiry to customers.
The pattern repeats across organisations of every size:
- Forgotten subdomains. The main site is watched carefully, but
status.,api.,shop.or an old campaign subdomain each carry their own certificate — and each expires on its own schedule. - Supplier-managed certificates. Your booking system, support portal or payment page may run on your domain but be operated by a third party. When their renewal slips, the warning appears under your name.
- No shared inventory. Renewal knowledge lives in one person's calendar or a spreadsheet that stopped being updated two reorganisations ago. When that person changes roles, the reminders go with them.
None of this is carelessness. It is what happens when certificates are treated as a set-and-forget task rather than something that needs continuous visibility.
What is the 47-day certificate lifetime rule?
The CA/Browser Forum has decided to shorten the maximum lifetime of public TLS certificates in steps: to 200 days in March 2026, 100 days in March 2027, and 47 days by March 2029. Every publicly trusted certificate authority must follow the schedule, so no website can opt out.
The CA/Browser Forum is the industry body where certificate authorities and browser makers agree the rules for publicly trusted certificates. Its decisions bind every CA that wants its certificates accepted by mainstream browsers — which means the schedule applies to your certificates whether you follow the standards process or not:
- March 2026: maximum lifetime drops to 200 days.
- March 2027: maximum lifetime drops to 100 days.
- March 2029: maximum lifetime drops to 47 days.
A certificate that today can be left alone for about a year will, by 2029, need renewing roughly every six weeks.
Do shorter certificate lifetimes improve security?
Yes, that is the reasoning behind the change. A shorter lifetime limits how long a compromised or wrongly issued certificate remains usable, and it reduces the web's dependence on revocation checking, which browsers apply inconsistently. The trade-off is operational: renewals become far more frequent, so processes built around a rare annual renewal stop working.
Shorter lifetimes also mean the information inside a certificate — the domain names it covers, the organisation it identifies — is re-validated more often, so stale or incorrect certificates age out of the ecosystem faster.
What this means for renewal frequency
The practical consequence is simple arithmetic. A renewal process that runs once a year can survive being manual: someone gets an email from the CA, someone follows a checklist, and the occasional near-miss stays a war story. Run that same process eight times a year for every certificate you own, and near-misses become incidents.
Most teams will respond by automating issuance and renewal where their infrastructure allows it, and that is the right direction. But automation does not remove the need for oversight — it changes what oversight means. Automated renewal fails quietly: a DNS change breaks the validation step, a supplier's automation misfires, a decommissioned-but-still-live host drops out of the renewal loop. The only way to know your renewals are actually happening, wherever they are managed, is to watch the certificates themselves — from the outside, the way a browser does.
What does a certificate monitoring safety net look like?
A useful safety net starts with a continuously updated inventory of every certificate on your domains, including forgotten subdomains and supplier-managed hosts. On top of that come chain and revocation checks, because a certificate can fail long before it expires, and scheduled reminders — for example 30 and 10 days before expiry — sent while there is still time to act.
In practice that means:
- Discovery, not data entry. The inventory must find certificates you did not know about — including those visible in Certificate Transparency logs — rather than relying on someone remembering to register them.
- Health checks beyond the expiry date. Incomplete chains, untrusted roots, weak keys, deprecated signature algorithms and revoked certificates all break trust while the expiry date still looks fine.
- Reminders timed for action. A warning 30 days out gives time to plan; a second at 10 days acts as escalation. A warning the day before is just a countdown to the outage.
As lifetimes shrink, the reminder windows become a larger share of each certificate's life — which is exactly the point. In a 47-day world, "we'll get to it next month" is no longer an option, and the safety net has to notice problems within days, not quarters.
Where CertControl fits
CertControl, the certificate intelligence product in TrustCtrl, is built as that safety net. It continuously discovers and inventories the certificates on your domains — including via Certificate Transparency logs — lists every SAN name, validates chains, checks revocation status, and flags weak keys, deprecated signature algorithms and TLS policy issues. Expiry reminders arrive 30 and 10 days ahead, with a notice if a certificate does lapse, and a revoked certificate is treated as urgent.
One thing worth being clear about: TrustCtrl monitors certificates, it does not renew them. Renewal stays with your CA, your tooling or your supplier — CertControl's job is to make sure a renewal that fails, or a certificate nobody knew about, never gets to surprise your customers.