Auto-Renew Isn't Enough for 100-Day Certificates
"I've set up auto-renew, so my certificates are handled." Almost everyone says this, and most of the time they're right.
The trouble is the rest of the time. A certificate that lasted a year gave auto-renew one shot at breaking. From March 15, 2027, new public certificates last 100 days at most. That's about four renewals a year, and any one of them can go wrong.
What's changing
In April 2025 the CA/Browser Forum voted to cut certificate lifetimes in steps. That's the group of browser makers and certificate authorities that sets the rules for public certificates. Apple, Google, Mozilla and Microsoft all voted yes.
| From | Longest a certificate can last | Renewals a year (roughly) |
|---|---|---|
| Before March 15, 2026 | 398 days | 1 |
| March 15, 2026 | 200 days | 2 |
| March 15, 2027 | 100 days | 4 |
| March 15, 2029 | 47 days | 8 |
We're already on the 200-day step. Domain validation gets shorter too: a CA can reuse it for 100 days from March 2027, and for only 10 days from March 2029.
Where auto-renew falls short
It only renews what it knows about, and when it breaks it often doesn't tell anyone. A DNS change stops validation. The server never gets reloaded, so it keeps serving the old certificate. A new certificate leaves out a hostname.
We run into this. One site we checked renews its bare domain just fine, while www is still serving a certificate that expired in April 2023.
In our experience it's usually the www or non-www version of a domain, or an old hostname nobody remembers.
Big companies get caught too
This doesn't only happen to small sites. All four of these named an expired certificate as the cause:
| Date | Company | What happened | Proof |
|---|---|---|---|
| May 2023 | Cisco | An expired root certificate hit vEdge SD-WAN routers | Cisco |
| Feb 2021 | Google Voice | An expired TLS certificate stopped calls from connecting | BleepingComputer |
| Feb 2020 | Microsoft Teams | An expired authentication certificate took Teams offline | SiliconANGLE |
| Dec 2018 | Ericsson (O2, SoftBank) | An expired certificate in Ericsson software disrupted mobile service | Ericsson |
None of them are short on engineers.
What we'd do
Keep a list. Every hostname and certificate you run: www and non-www, subdomains, old hosts, VPN gateways, internal services. If it isn't on the list, nobody is going to renew it.
Automate everything on it. Renewing by hand four times a year is a chore. At 47 days it stops being realistic.
Check from the outside. Do it separately from your renewal tool, because a broken tool won't tell you it's broken. Set alerts at 30, 14 and 7 days, and send them to more than one place, like email and Slack. Yes, that's a few extra emails. They're easier to deal with than a customer telling you your site shows a security warning.
Where CertAvert fits
This is what we built CertAvert for. It checks your certificates from the outside and emails you before one expires. Every plan includes monitoring, and Plus and Pro add an inventory.
The free tools don't need an account: expiry and trust, names and SANs, certificate chain, TLS versions and ciphers, DNS and domain registration and certificate lifetime. For hosts that aren't public, there's a free scanner you run on your own network.
Check yours
March 15 is less than five months away. Put both the www and non-www versions of your domains through the SANs tool and the expiry tool.
If you'd like an email before something expires, sign up free. The Free plan emails you 30 days before and on the day. Paid plans add 14 and 7 days.