HTTPS and SSL/TLS certificates: why lifetimes are dropping to 47 days

HTTPS is the protocol that encrypts the traffic between a browser and a web server and proves that the server on the other end really is the site it claims to be. The thing that provides that trust is the SSL/TLS certificate: a digital document, signed by a trusted certificate authority (CA), that binds your domain name to an encryption key. A big change is now on the way. A decision taken in April 2025 will gradually cut the maximum certificate lifetime from today's 398 days down to 47 days by 2029. The era of renewing a certificate by hand once a year is ending, and automation has moved from nice-to-have to mandatory.

What HTTPS actually does

HTTPS is really "HTTP plus TLS." TLS does two jobs. The first is encryption: the data between you and the server is scrambled so that nobody in the middle can read it or change it. The second is authentication: the certificate proves that the owner of the address you connected to really is who they say they are. When the browser sees a signature from a CA it knows and trusts, it shows the padlock in the address bar. If the signature is invalid or the certificate has expired, it stops the visitor with a full-page warning.

Without a certificate, your data is in the open

Everything you send over plain HTTP travels as clear text. Someone on the same network, for example a person sitting on public Wi-Fi, can read your password and form data, and can even inject their own content into the page. That is why HTTPS is now the rule rather than the exception. Google's data shows the vast majority of web traffic is encrypted, and with Chrome 154 in October 2026 the browser will make "Always Use Secure Connections" the default. Search engines also treat HTTPS as a ranking signal, and unencrypted pages get flagged as "Not secure" in the browser.

The padlock does not mean "safe site"

A common misunderstanding is worth clearing up: the padlock in the address bar does not mean the site is trustworthy. It only tells you the connection is encrypted. Phishing sites happily obtain free certificates and show the same padlock today. The padlock means "nobody is listening in," not "you can safely send this company money." Checking that the domain name is spelled correctly is still your job.

DV, OV, EV: the difference

Certificates come in three validation levels. DV (domain validation) only proves you control the domain and is issued automatically within minutes. OV and EV also verify the identity of the organization behind the site. EV certificates once showed a green company name in the browser, but browsers have removed that visual distinction, so for most sites DV is enough today. The strength of the encryption is identical across all three; the only difference is who gets verified.

The real change: certificate lifetimes fall to 47 days

Ballot SC-081v3, passed almost unanimously by the CA/Browser Forum in April 2025, cuts the maximum certificate lifetime in three steps: 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029. The proposal came from Apple, and every major browser maker, including Google, Microsoft and Mozilla, voted in favor. The same decision also shrinks the reuse period for domain validation from 398 days to 10 days. The logic is simple: the shorter a certificate lives, the smaller the window of exposure if a key is stolen or a certificate is issued in error. Because certificate revocation mechanisms (CRL and OCSP) are slow and unreliable in practice, short lifetimes are seen as the cleanest fix.

Let's Encrypt and the rise of automation

None of this is new in direction. Let's Encrypt, which started issuing free, automated certificates in 2015, made HTTPS accessible to everyone and normalized short 90-day certificates. In January 2025 it went a step further and announced a 6-day certificate option, issuing the first one in February 2025. A lifetime that short is only workable through a protocol called ACME, where machines renew the certificate on their own with no human involved. The direction of travel is clear: lifetimes keep shrinking and renewal keeps getting automated.

What an expired certificate costs a business

When a certificate expires, the browser meets your visitor with a full-page security warning, and most people turn back. Your site is technically still running, yet it becomes unreachable. This is not a minor glitch. In February 2020 Microsoft forgot to renew a certificate and Teams went down worldwide for about three hours. In 2018 a single expired certificate at Ericsson knocked out mobile service for tens of millions of subscribers across several countries. These are some of the largest technology companies in the world; the problem was not a lack of knowledge but a single date slipping through the cracks.

Manual renewal is no longer possible

This is where 47 days really lands. You could note a once-a-year renewal in a calendar. At 47 days you have to renew roughly every month, well before the thirty-day mark, and not for one server but for every certificate you own. Doing that by hand is both impossible and a recipe for exactly the outages above. The fix is an ACME client (such as certbot) that automates renewal, plus a system that tracks expiry dates and warns you in advance.

How to prepare

Preparation comes down to a few concrete steps:

• Build an inventory. List not just your main website but every certificate on APIs, load balancers, mail servers and internal systems. Outages usually come from the one certificate everybody forgot about.
• Automate renewal. Set up an ACME client and make sure your hosting provider or CDN supports automatic renewal.
• Add monitoring and alerts. See every certificate's expiry date in one place and get warned days before it lapses.
• Turn on HSTS. Tell browsers to always connect to your domain over HTTPS so they never fall back to plain HTTP.

The move to 47 days completes in 2029, but the first cut begins in March 2026, only a few months away. For any team that manages certificates by hand, the question is plain: can you see, from one place, how many certificates you have today and when each one expires? Building that inventory and automating renewal removes both the outages and the midnight panic calls. At Wedevit we map your certificate inventory, set up automatic renewal and monitoring, and harden your HTTPS configuration as part of a broader zero trust approach.