SSL Certificate Lifetimes Are Shrinking: the Manual-Renewal Era Is Over

Behind the padlock in your browser's address bar runs a calendar: SSL/TLS certificates must be renewed at intervals, and the industry's joint rule-making body is shortening that interval step by step. From March 2026, newly issued certificates are valid for at most about 200 days; the rest of the schedule is already published — around 100 days from 2027, 47 days from 2029. For businesses running on the "one certificate day per year" routine, this is a quiet but definitive operational change: the same task arrives first two or three times a year, and within a few years, nearly every month.

Why Shorter?

The decision is not arbitrary. Long-lived certificates carry two structural problems: a compromised or mis-issued certificate remains a threat for its entire lifetime (revocation mechanisms have never worked reliably enough in practice), and when cryptographic standards move on, old certificates drag through the ecosystem for years. Short lifetimes narrow the window of a bad certificate and make the whole ecosystem quick to adopt improvements. The price is operational: renewal frequency rises beyond what hands can carry.

What It Means for Your Business: Simple Arithmetic

Period	Max lifetime	Renewals per certificate per year	Annual operations for a 10-certificate estate
Old regime	~13 months	1	10
From March 2026	~200 days	2	~20
From March 2027	~100 days	4	~37
From March 2029	47 days	~8	~78

Every manual renewal is a chain of remembering, purchasing/signing, installing and verifying — and every link is an opportunity to forget. The bill for an expired certificate is well known: every visitor greeted by a browser warning, mail clients refusing connections, integrations stopping silently. Expecting 78 flawless manual operations a year is not realistic — by design, this schedule exists to make automation mandatory.

First Step: the Certificate Inventory

Ask a business and it says "we have a website"; a scan says otherwise. Typical certificate-bearing points:

• The website and its subdomains (stage, portal, api)
• The mail server/gateway and webmail interface
• The VPN endpoint and the firewall management interface
• Devices with management panels — NAS, camera recorders, printers
• Internal applications and service-to-service (API) traffic

Each inventory row records three facts: who issues the certificate, where it is installed, and who or what renews it today. Without this table, talking automation is premature — you cannot accelerate a calendar without knowing which doors are on it.

The Solution: Automated Renewal with ACME

The good news: this problem was solved years ago. The ACME protocol handles certificate request, validation, installation and renewal without a human. The Let's Encrypt ecosystem is the proof — millions of sites have run for years on 90-day certificates without incident, because nobody renews them by hand. Commercial certificate authorities offer the same protocol; the "enterprise certificate = manual work" equation is obsolete. Three patterns cover practice:

• ACME built into the web server: modern web servers and reverse proxies renew on their own — the lowest-effort route.
• A central ACME client: certificates are obtained at one point and distributed to the systems that need them; simplifies multi-service estates.
• DNS-validated wildcard certificates: where subdomains are numerous, one wildcard managed through DNS-based validation cuts the workload; API support at your DNS provider is the precondition.

Exceptions that resist automation always surface — an old device with no API, an integration with a bespoke signing chain. The right treatment is not to ignore them but to keep them on a separate "manually renewed" list with reminders that fire weeks before expiry.

The Last Layer: Monitoring

Automation must itself be watched; a silently broken renewal job goes unnoticed until expiry day. In a healthy setup, every certificate's expiry date feeds the monitoring system, with a warning at 30 days and an alarm at 14. The margin of error then becomes an alert IT sees — not a browser warning your customer sees.

What Yamanlar Bilişim Takes On

Our certificate work runs in three steps: external scanning and inventory to map your certificates; wiring every automatable point into an ACME arrangement; and writing the exceptions into a scheduled watch list with expiry alarms. For maintenance-agreement customers, certificate health is a monthly check item — the 47-day era is entered with a system that is already ready.

FAQ