The maximum life of a public TLS certificate fell to 200 days on 15 March 2026. On 15 March 2027 it drops again, to 100 days.
If you renewed certificates manually this year and it felt manageable, next year it will not. Roughly four renewals a year becomes closer to eight in 2029, when the limit falls again to 47 days.
What to put in place now
An inventory. Every certificate, every hostname it covers, and its expiry date. Most businesses cannot produce this, which is the first problem rather than a side issue.
Automated issuance and renewal. Anything relying on a calendar reminder will fail eventually — not through carelessness but through frequency.
Monitoring that is independent of the renewal process. If automation breaks silently, you want to hear about it from a monitor rather than a customer.
Correct hostname coverage. Certificates need to cover every name people actually use, including www. A mismatch throws a warning for a large share of visitors.
A CAA record. This restricts which certificate authorities may issue for your domain — a small, free control that most businesses skip.
The one thing not to do
Do not buy a longer certificate hoping to outrun the change. Validity limits apply at issuance, so a certificate bought the day before a deadline still cannot exceed the limit in force when it is issued.
Our managed SSL service handles issuance, installation, renewal and monitoring, and it is included as standard with our hosting. Call 01202 835235.