Certificate Lifetimes Just Got Cut to 825 Days — and the Trend Points Shorter

A quiet change took effect on March 1st that will eventually touch every website with a padlock: newly issued TLS certificates are now capped at 825 days — roughly 27 months — down from the previous maximum of 39 months. No browser warning announced it, no vendor emailed you about it, but the next time you renew, the three-year option simply won't be there.

On its face this is a bookkeeping change. In practice it's the clearest signal yet of where the industry is headed: certificate lifetimes have been shrinking for years, the pressure to shrink them further is only building, and every cut makes "we'll remember to renew it" a worse strategy. Here's what changed, why, and what it means for how you run renewals.

What changed on March 1st

The new cap comes from the CA/Browser Forum — the industry body of certificate authorities and browser vendors that sets the baseline rules every publicly trusted CA must follow. The relevant ballot passed last year; since March 1, 2018, no publicly trusted CA may issue a certificate valid for more than 825 days.

The details worth knowing:

• Existing certificates are unaffected. A three-year certificate issued in February 2018 remains valid until it expires. The cap applies to new issuance only.
• The re-use window for validation data also shrank to 825 days. CAs must re-verify your control of a domain at least that often — no more coasting on a years-old validation.
• This continues a steady ratchet. Five-year certificates disappeared in 2015, then the cap dropped to 39 months. Now 27. A proposal to cut lifetimes to around 13 months was floated at the Forum last year — it failed, but the browsers' appetite was unmistakable. Nobody serious expects 825 days to be the floor for long.

Why the industry keeps shortening lifetimes

Shorter lifetimes look like pure inconvenience — more renewals, more chances to fumble one. The browsers push for them anyway, for reasons that are hard to argue with:

• Revocation is broken. In theory, a compromised certificate gets revoked and browsers reject it. In practice, revocation checking (CRLs, OCSP) is so unreliable that browsers frequently soft-fail — if the revocation check doesn't answer, the certificate is accepted anyway. The only revocation mechanism that actually works at internet scale is expiry. Shorter lifetimes shrink the window in which a stolen key is useful.
• Mis-issuance cleanup takes years — literally. When a CA is caught issuing certificates improperly, the bad certificates stay valid until they expire. The industry is living through this right now: browsers are progressively distrusting Symantec-issued certificates throughout 2018, a process made agonizing precisely because so many long-lived certificates are still out there. With 39-month certs, a CA's mistakes linger for over three years; 27 months trims that tail.
• Agility. The ecosystem regularly needs to move: deprecating SHA-1 signatures, migrating to stronger keys, rolling out new validation requirements. Every improvement rolls out only as fast as the oldest surviving certificate ages out. Shorter lifetimes mean the whole web can adopt fixes faster.

Notice that every one of these arguments gets stronger at shorter lifetimes. That's why the trend line only points one way.

The operational reality: audit what you have

Most organizations discover they have more certificates than they thought — the www domain, the API, the staging box someone secured properly (good!) and forgot (bad), the mail server, the load balancer with a cert baked into its config. Step one is an inventory. For any host you can reach, checking the expiry date takes one command:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -enddate

Build the list, record each certificate's expiry, issuer and where it's deployed (renewing a cert and forgetting to install it on the second load balancer is a classic), and you have the raw material for an actual renewal process.

Calendar reminders don't scale — automation plus verification does

The traditional renewal process is a calendar reminder in one person's inbox. That was already fragile at three-year intervals; at 27 months — and wherever the cap lands next — the math turns against you. More certificates renewing more often means more renewal events per year, and each one is a chance for the reminder to land during a vacation, go to a departed employee's mailbox, or get snoozed into oblivion. Expired certificates are consistently among the most common — and most embarrassing — causes of website outages, and every one of them was preceded by months of theoretical warning.

The sustainable answer has two independent halves:

• Automate renewal. This is increasingly the norm, not the exception. Let's Encrypt issues free 90-day certificates renewed entirely by software via the ACME protocol — 90 days being a deliberate design choice: short enough that automation is mandatory, which is precisely the point. Commercial CAs are building out their own automation APIs. If a human currently performs your renewals by hand, that's the thing to fix this quarter.
• Monitor expiry independently. Automation fails silently: the cron job that runs the renewal client stops, a DNS change breaks domain validation, the renewed certificate never gets deployed to one of the servers. An external monitor that connects to your real endpoints, reads the certificate actually being served, and alerts at 30, 14 and 7 days out catches every one of those failure modes — because it verifies the outcome, not the process. Automation without verification is just a quieter way to be surprised.

Shorter lifetimes reward the prepared

The 825-day cap won't be the last cut — the arguments for shorter certificates all compound, and the browsers hold the leverage. Teams with automated renewal and independent expiry monitoring will barely notice each future reduction; teams running on memory and calendar invites will feel every one as an increase in outage risk.

CompleteStatus watches the certificates your servers actually serve — expiry countdowns with alerts well before the deadline, plus checks for chain and configuration problems — alongside uptime and DNS monitoring in one dashboard. Create a free account, add your domains, and make certificate expiry one alarm that always goes off early — no matter how short the lifetimes get.