The SSL/TLS industry is undergoing one of the most important changes in certificate management in recent years.
The maximum validity period of publicly trusted SSL/TLS certificates has been reduced from 398 days to approximately 200 days — and this is only the first step.
Over the next few years, certificate lifetimes will become progressively shorter, eventually reaching just 47 days in 2029.
For website owners and system administrators, this means one thing above all: SSL certificate management will need to become much more frequent.
And as certificate lifetimes continue to shrink, SSL automation will move from being a convenient feature to becoming an essential part of certificate management.
SSL Certificate Validity: What Is Changing?
The CA/Browser Forum has approved a gradual reduction in the maximum validity period allowed for publicly trusted TLS certificates.
The new schedule is:
| Effective date | Maximum SSL/TLS certificate validity | Approximate replacements per year |
|---|---|---|
| March 15, 2026 | 200 days | ~2 |
| March 15, 2027 | 100 days | ~4 |
| March 15, 2029 | 47 days | ~8 |
Until recently, a publicly trusted SSL certificate could remain valid for up to 398 days.
With the first phase of the new rules, certificates must now be replaced approximately twice as often.
But the real operational change will arrive over the next few years.
When the maximum lifetime reaches 47 days in 2029, organisations managing certificates manually may need to replace each certificate around eight times every year.
For companies managing dozens, hundreds or thousands of certificates, traditional manual certificate management will become increasingly difficult to maintain.
Why Are SSL Certificate Lifetimes Becoming Shorter?
Shorter certificate lifetimes are intended to improve the security and reliability of the Web PKI ecosystem.
An SSL/TLS certificate contains information that was verified when the certificate was issued. Over time, that information can become outdated.
Domains can change ownership. Organisations can change their details. Infrastructure can be replaced. Private keys can also potentially become compromised.
Reducing certificate lifetimes limits the period during which outdated credentials or certificate information can remain valid.
Shorter certificate lifetimes also encourage more frequent key rotation and allow changes in security requirements to propagate through the Web PKI more quickly.
There is, however, an obvious consequence: certificates must be issued and deployed much more frequently.
Does a 200-Day Certificate Mean You Have to Buy SSL Twice a Year?
No.
It is important to distinguish between the subscription or coverage period you purchase and the validity period of the individual certificate installed on your server.
You may still purchase SSL coverage for one or multiple years, depending on the product.
However, the individual certificate issued during that subscription can only remain valid for the maximum period permitted by current industry requirements.
When it reaches that limit, a new certificate must be issued and installed.
Therefore, shorter certificate lifetimes do not necessarily mean buying certificates more frequently.
They mean reissuing and replacing certificates more frequently.
Validation Periods Are Becoming Shorter Too
Certificate validity isn’t the only thing changing.
The CA/Browser Forum changes also progressively reduce how long Certificate Authorities can reuse previously verified validation information.
This is particularly important for Domain Control Validation (DCV), which proves that the certificate applicant controls the domain for which the certificate is being issued.
As validation reuse periods become shorter, domain validation will also need to be performed more frequently.
The direction of the industry is therefore clear: both certificate issuance and validation are becoming increasingly frequent processes.
And that makes automation increasingly important.
The Problem With Manual SSL Certificate Management
Replacing an SSL certificate manually isn’t particularly difficult when you only manage one certificate once a year.
Typically, the process involves several steps:
- generating or submitting a Certificate Signing Request (CSR);
- completing Domain Control Validation and, where applicable, organisation validation;
- obtaining the newly issued certificate;
- installing it on the server;
- verifying that the certificate and certificate chain are correctly installed;
- monitoring the next expiration date.
Doing this once a year for a handful of certificates is manageable.
Doing it eight times per year for every certificate is a very different situation.
Imagine an organisation managing 100 SSL certificates.
With certificates lasting approximately one year, this could mean around 100 certificate replacement operations annually.
With 47-day certificates, the same infrastructure could require around 800 certificate replacements every year.
At that point, relying on spreadsheets, calendar reminders and manual installations becomes both inefficient and risky.
Certificate Expiration Becomes an Increasing Operational Risk
An expired SSL certificate can make a perfectly functioning website or service appear broken or insecure.
Browsers may display security warnings, APIs may refuse connections and automated services may stop communicating.
As certificate lifetimes become shorter, there are more opportunities for a forgotten renewal or installation to cause an outage.
This is why the move toward shorter certificates is closely connected with another major development in the SSL industry:
certificate lifecycle automation.
ACME: Automating the SSL Certificate Lifecycle
ACME — the Automatic Certificate Management Environment — is a standardised protocol designed to automate certificate issuance and management.
Instead of an administrator manually requesting, validating, downloading and installing a certificate, an ACME-compatible server or client can communicate directly with the Certificate Authority.
Depending on the certificate and infrastructure, ACME can automate tasks such as:
- certificate requests;
- Domain Control Validation;
- certificate issuance;
- installation;
- renewal and replacement;
- certificate lifecycle management.
Once correctly configured, certificates can therefore be replaced automatically before they expire.
This makes the actual lifetime of an individual certificate far less important from an operational perspective.
Whether a certificate lasts 398 days, 200 days, 100 days or 47 days, the automated system simply requests and deploys a new one when required.
From SSL Renewal to SSL Automation
For many years, SSL certificates have been treated like products with an expiration date.
You purchased a certificate, installed it and added a reminder to renew it approximately one year later.
That model is gradually disappearing.
The future of SSL/TLS is better understood as a continuously managed certificate lifecycle.
Certificates will be issued, validated, deployed and replaced automatically as part of the infrastructure they protect.
This approach is already common with automated Domain Validated (DV) certificates, but shorter certificate lifetimes will make automation increasingly valuable for businesses and organizations managing larger certificate inventories as well.
200 Days Is Only the Beginning
The reduction to 200-day SSL certificates is important, but it should not be viewed in isolation.
It is the first stage of a much larger transition:
398 days → 200 days → 100 days → 47 days
By March 2029, publicly trusted TLS certificates will have a maximum lifetime of only 47 days.
That means organisations planning their certificate management strategy today should not design their processes around the current 200-day limit.
They should prepare for an environment where certificates are routinely replaced every few weeks.
Manual processes that are merely inconvenient today may become impractical within a few years.
Preparing Your SSL Infrastructure for Shorter Certificate Lifetimes
Organisations should start reviewing how their SSL/TLS certificates are currently managed.
Some useful questions include:
- How many certificates do we manage?
- Who is responsible for renewing and installing them?
- Do we have a complete inventory of certificates and expiration dates?
- What happens if the person responsible for renewal misses a notification?
- Can our servers and applications use ACME?
- Which certificates can already be migrated to automated issuance?
- Are certificate renewals part of our infrastructure automation?
The sooner certificate lifecycle automation is introduced, the easier the transition to 100-day and eventually 47-day certificates will be.
SSL Automation Is Becoming the New Standard
Shorter certificate lifetimes provide security benefits, but they also fundamentally change how SSL certificates need to be managed.
At 200 days, manual certificate management may still be practical for small environments.
At 100 days, it becomes significantly more demanding.
At 47 days, manually tracking and replacing large numbers of certificates becomes difficult to justify.
The solution is not to spend more time managing certificates.
It is to automate the certificate lifecycle.
At EuroSSL, we are progressively expanding our range of SSL certificates and solutions supporting automated certificate management, including ACME-compatible products designed to simplify certificate issuance, renewal and deployment.
As the industry moves toward 47-day certificates, automation will no longer simply save time.
It will become a fundamental part of reliable SSL/TLS certificate management.
SSL Automation Options: Which Approach Is Right for You?
There is no single way to automate SSL/TLS certificate management. The right solution depends on your infrastructure, the number of certificates you manage, and how much control and integration your organisation requires.
For a website owner managing a single server, a lightweight automation agent may be all that is needed. Hosting providers need solutions capable of handling certificates across multiple customers and hosting control panels. ACME provides a flexible, standardised approach that works across a growing number of platforms, while larger organisations may require a complete Certificate Lifecycle Management (CLM) platform.
Here is a quick comparison of the main approaches:
| Automation option | Best suited for | Typical environments | Key features | |
|---|---|---|---|---|
| Server-based SSL automation (Autoinstall) | Website owners and system administrators managing individual cloud, VPS or dedicated servers | Linux with Apache or NGINX, Windows IIS | Automated certificate issuance, installation and renewal; certificate monitoring and expiration alerts; relatively simple initial setup | Buy now |
| Hosting-oriented SSL automation | Web hosting companies, resellers and managed service providers | cPanel, DirectAdmin, Plesk, WHMCS and other hosting environments | Automated certificate lifecycle management across multiple customers; automatic reissuance and renewal; centralised management and customer-facing integration | Contact us |
| ACME-enabled SSL certificates | Website owners, developers, hosting providers and organizations looking for a standardized and flexible automation method | Linux, Windows IIS, cPanel, Plesk, Kubernetes, cloud environments and many other platforms | End-to-end certificate automation using the standardised ACME protocol; automated validation, issuance and renewal; wide compatibility with existing ACME clients and agents | Buy now |
| Certificate Lifecycle Management (CLM) platforms | Enterprises and organizations managing large or complex certificate infrastructures | Multi-cloud, hybrid infrastructure, enterprise networks and custom environments | Automated certificate discovery, issuance, deployment, renewal and revocation; centralized certificate inventory; monitoring, policies, advanced controls and integration with enterprise systems | Contact us |
From Simple Automation to Complete Certificate Lifecycle Management
The important point is that SSL automation does not necessarily require a complex enterprise platform.
If you manage a relatively small number of certificates, an ACME-enabled SSL certificate combined with a compatible ACME client can provide a simple and effective way to automate issuance and renewal. Many popular web servers, hosting panels, operating systems and orchestration platforms already support ACME directly or through readily available clients.
Hosting providers can take automation a step further by integrating certificate management directly into their hosting platforms, allowing certificates to be issued and renewed automatically for multiple customers.
At the other end of the spectrum, organisations managing hundreds or thousands of certificates may benefit from dedicated Certificate Lifecycle Management platforms. These systems can discover certificates throughout the infrastructure and centrally manage their issuance, deployment, renewal, revocation and monitoring.
The objective, however, is the same in every case: remove repetitive manual operations from the certificate lifecycle and reduce the risk of certificates expiring unexpectedly.
As SSL/TLS certificate validity falls from 200 days to 100 days and eventually just 47 days, choosing an appropriate level of automation will become increasingly important. For many website owners and hosting environments, ACME offers an especially attractive solution because it combines standardisation, broad compatibility and end-to-end automation without requiring a complex certificate management infrastructure.
