Public Certificates Drop to 100 Days in March 2027: Check Every Renewal in 30 Minutes

A note to forward to your team

Certificate renewal check

Public certificates can last at most 100 days from 15 March 2027 and 47 days from 15 March 2029. Every certificate that still renews by hand becomes recurring work and a likely outage.

Please run the crt.sh search in this note for every domain we own by [date] and reply with three numbers:
1. Public certificates found that are still valid
2. Certificates that renew automatically
3. Certificates that need a person

Owner: [name]
Note: https://stonetusker.com/insights/100-day-tls-certificates.html

Why it matters now

In April 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public certificates, approved ballot SC-081v3.¹ The maximum lifetime fell from 398 to 200 days on 15 March 2026. It falls to 100 days on 15 March 2027, less than five months from now, and to 47 days on 15 March 2029.

At 47 days each certificate renews about eight times a year. A manual step that happened once a year becomes recurring work, and each renewal is a date that can be missed. With 200 certificates that need a person, at 30 minutes each, a team spends about 90 hours a year at 398-day lifetimes and close to 800 hours a year at 47 days.

The main website usually renews by itself. Outages come from the edges: certificates uploaded by hand to a load balancer or gateway, appliances, partner integrations that pin your certificate, mobile apps and devices, and certificate files baked into images.

Check your public certificates in 30 minutes

Step 1. List every public certificate

Every publicly trusted certificate appears in the public Certificate Transparency logs, and crt.sh offers a free search over them.⁴ Replace example.com with your domain and repeat for every domain the business owns, including older brands and regional domains.

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[] | [.common_name, .issuer_name, .not_after] | @tsv' \
  | sort -u

The list also shows expired certificates. Keep the ones whose expiry date is still in the future.

Step 2. Check one endpoint directly

echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
  | openssl x509 -noout -issuer -enddate

Step 3. Mark how each one renews

Put the list in a spreadsheet and add one column: renews automatically, yes or no. Please be strict. A calendar reminder counts as no.

What the result means

The rows marked "no" form your project. ACME here means the Automated Certificate Management Environment protocol.

The move, step by step

1. Build the inventory. Pull every public certificate from the Certificate Transparency logs, add internal certificates, and record where each one is deployed and who owns it.
2. Move to the ACME protocol. Use cert-manager in Kubernetes, a standard client on hosts, or managed certificates from your cloud provider.
3. Automate domain validation. Validate through your domain name provider's interface with credentials limited to the validation records, and retire email approval.
4. Monitor expiry separately. Alert from a system that is separate from the renewal system when a certificate has less than a third of its lifetime left.
5. Remove pinning and baked-in certificates. Load certificates at run time, and replace leaf-certificate pinning in apps, devices and partner configurations.

Clients that support ACME Renewal Information (RFC 9773) let the certificate authority say when to renew, including early renewal after a mass revocation. Without it, Let's Encrypt recommends renewing at about two thirds of the lifetime.^3,6 Its staging environment has issued 64-day certificates since 14 October 2026, so you can test your automation against the shorter lifetime now.³

What is still open

• Some certificate authorities may adopt shorter lifetimes earlier than the ballot requires, as Let's Encrypt has. Please check the plans of the authorities you use.
• Support for ACME Renewal Information differs across clients, appliances and cloud services. Confirm it for each part of your estate.
• The renewal hours above are an illustration. Your figure depends on your certificate count and your current process.