The CA/Browser Forum voted in April 2025 to cut maximum certificate lifetimes from 398 days to 200 (March 15, 2026), 100 (March 15, 2027) and 47 (March 15, 2029). ACM moved to 198-day certificates in February 2026 and Let's Encrypt is heading to 45 days. What TLS does, what the change breaks, and how to make expiry a non-event.
TLS does three things: encrypts traffic, detects tampering, and proves the server holds a certificate for the domain from an authority browsers trust. It does not prove the site is honest. Phishing sites have valid certificates too.
CA/Browser Forum Ballot SC-081v3, passed April 11, 2025.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
AWS Certificate Manager: public certificates issued from February 18, 2026 last 198 days and renew 45 days before expiry. DNS-validated certificates renew automatically as long as the validation CNAME stays in DNS. Exportable public certificates dropped to $7 per name and $79 per wildcard.
Let's Encrypt: the opt-in tlsserver profile issues 45-day certificates from May 13, 2026; the default classic profile moves to 64 days on February 10, 2027 and to 45 days on February 16, 2028, when authorization reuse falls to 7 hours.
Platforms and CDNs that manage certificates for you (CloudFront with ACM, Amplify Hosting, Vercel, Netlify, Cloudflare) renew without you, provided their DNS checks keep passing.
Certificates installed by hand on a server or load balancer, renewed from a calendar reminder.
Validation records deleted in a DNS "cleanup", which quietly stops automatic renewal.
A CAA record that does not list the authority your provider uses.
Certificates pinned or bundled in mobile apps and devices, which now change more often than many release cycles.
Use managed certificates wherever you can.
On servers you run, use an ACME client (Certbot, Caddy, cert-manager on Kubernetes) and test renewal, not just issuance.
Monitor expiry from outside anyway, alerting 14 days ahead. It costs nothing and catches the automation that failed silently.
Do not pin leaf certificates in apps.
HSTS (the Strict-Transport-Security header, RFC 6797) tells browsers to use only HTTPS for your domain. Start with a short max-age; the browser preload list is slow to leave, so join it only when every subdomain serves HTTPS. TLS 1.3 (RFC 8446) completes its handshake in one round trip instead of two, which makes every new connection faster.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
DNS for App Builders: Records, TTLs, the Apex Problem, and Why "Propagation" Is Caching
What each DNS record does, why you cannot put a CNAME on your bare domain, why DNS changes seem to take hours, and how to stop the domain itself becoming your single point of failure. With Route 53 prices and the January 2025 switch from WHOIS to RDAP.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.