News · written 7 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

The little padlock in your browser depends on a TLS certificate: a file that proves a website really is the site it claims to be. Every certificate has an expiry date. Those dates are getting much closer together, and it affects everyone who runs a website — from big companies to a hobby blog.

What changed

In April 2025 the CA/Browser Forum — the group of certificate authorities and browser makers that sets the rules for public certificates — passed ballot SC-081. The certificate authorities voted 25 in favour and none against, and all four browser makers in the vote (Apple, Google, Microsoft and Mozilla) voted yes. It cuts the maximum lifetime of a public website certificate in steps:

• Before 15 March 2026: up to 398 days.
• From 15 March 2026: up to 200 days — this step is already in force.
• From 15 March 2027: up to 100 days.
• From 15 March 2029: up to 47 days.

The time a certificate authority may reuse an earlier check that you control a domain shrinks on the same dates: 200 days, then 100, and finally just 10 days from 2029.

Let's Encrypt is going further

Let's Encrypt, the free certificate authority used by a huge share of small sites (including this one), has issued 90-day certificates since 2015. In December 2025 it announced its own timetable:

• From 10 February 2027, its default certificates last 64 days, and a domain check can be reused for 10 days.
• From 16 February 2028, they last 45 days, and a domain check can be reused for only 7 hours.
• An opt-in profile was planned to switch to 45-day certificates earlier, for people who want to test, and even shorter 6-day certificates are already available on request.

Why make certificates expire sooner?

If a certificate is issued by mistake, or its secret key is stolen, the damage lasts until it expires — cancelling ("revoking") a certificate early has never worked very reliably across the internet. Shorter lifetimes shrink that window. Let's Encrypt also says shorter lifetimes push everyone to automate renewals, which it calls essential for reliability.

What it means if you run a website

• Automate renewal. Let's Encrypt says plainly that manually renewing certificates is not recommended. At 45 days, a manual renewal would be due every few weeks.
• Don't hard-code a schedule. A tool that renews "every 60 days" will stop working. Let's Encrypt recommends renewing about two thirds of the way through a certificate's life, or letting the client ask the server when to renew (a feature called ACME Renewal Information, or ARI).
• Watch for failures. Set up an alert for when a renewal fails, so a problem is caught before visitors see a warning.
• Wildcard certificates need extra care. A certificate for *.example.com is proved by adding a DNS record. With domain checks reusable for only hours by 2028, that DNS step has to be automatic too — for example through your DNS provider's API. Let's Encrypt has said it expects a new method that avoids repeated DNS changes.

None of this changes anything for people who only visit websites: browsers handle certificates on their own. It is a job for the people who run the sites.

Sources

• CA/Browser Forum — Ballot SC-081v3, April 2025 (the schedule and the vote).
• CA/Browser Forum — TLS Baseline Requirements (validity periods and data reuse dates).
• Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days, 2 December 2025 (its timetable and advice).
• Let's Encrypt — Certificate Lifetime Rationale and Plans (why lifetimes are getting shorter).

More news and guides at https://jmtechpower.com/articles.