Certificates drop to 200 days in March

From 15 March 2026, publicly trusted TLS certificates can be valid for 200 days at most, down from 398. It drops again to 100 days in March 2027, and to 47 days in 2029.

If your certificates renew automatically, through Let’s Encrypt, your host or Cloudflare, nothing changes for you. If someone buys a certificate once a year and installs it by hand, that person is about to do it twice a year, then four times, then eight. Sooner or later one gets missed and the site goes down.

This month:

• List every certificate you own, including the ones on firewalls, mail servers, VPNs and old internal apps.
• Mark which ones renew themselves and which don’t.
• Move the manual ones to ACME, or ask your vendor how they’ll handle the shorter lifetime.
• Add expiry monitoring that warns you two weeks ahead.

Short certificates are a good thing. Manual renewal isn’t.