Why certificates are getting shorter
In July 2026, AWS announced native ACME protocol support in its certificate management services, a strong signal that the industry is converging on mandatory automation. The CA/B Forum voted on a progressive validity reduction schedule with a dual goal: limit exposure to compromised keys and force regular renewal of cryptographic parameters. An expired certificate or one relying on an old key represents a measurable attack surface. Shortening the validity period mechanically reduces this window, provided renewal is reliable and automatic.
The concrete risks of manual renewal
- Silent expiration — a manually renewed certificate depends on a calendar alert or a human reminder, two mechanisms that regularly fail during busy periods or team changes.
- Late alerts — standard monitoring tools warn about expiration at 30 days, a margin designed for annual certificates; with 47-day certificates, this window no longer provides enough time to act calmly.
- Frozen cryptographic parameters — manual renewal encourages reusing the same configuration; automation instead enforces a key and hash policy applied consistently.
- SLA impact — a service interruption caused by an expired certificate creates contractual liability and damages the platform's reputation.
- Growing operational burden — moving from one renewal per year to eight renewals per year per domain multiplies manual workload without added value for technical teams.
The timeline: what changes and when
The current maximum validity period is 398 days, a cap set after browsers stopped trusting certificates exceeding that limit. The CA/B Forum voted in 2024 on a progressive schedule: from March 2027, the maximum duration will be reduced to 100 days. A second step, planned for 2029, will lower this cap to 47 days. Let's Encrypt is already anticipating this trajectory by issuing 90-day certificates. By 2029, manually managing even a dozen domains will be structurally impossible without automated tooling.
Automating ACME renewal
Inventory existing certificates
Before automating, take stock of all active certificates: domains covered, issuing authorities, expiration dates, validation method (HTTP-01, DNS-01, TLS-ALPN-01). On Linux, certbot certificates lists managed certificates. For others, openssl s_client -connect your-domain.com:443 shows the issuer and expiration date.
Choose a suitable ACME client
certbot is the EFF's reference client, available in the repositories of all major Linux distributions. acme.sh is a shell script with no external dependencies, particularly suited to DNS-01 validation scenarios. If your web server is Caddy, no third-party client is needed: Caddy manages the ACME protocol natively.
Configure automatic renewal
With certbot, the package automatically installs a systemd timer that attempts renewal twice a day. Check it is active: systemctl status certbot.timer. With acme.sh, the command acme.sh --install-cronjob adds the necessary cron entry. With 47-day certificates, adjust the renewal threshold to 15 days.
Test renewal before the deadline
Never assume the configuration is correct without verifying it. Run certbot renew --dry-run to validate the chain without issuing a real certificate. If the test passes, follow up with certbot renew --force-renewal on a non-critical domain to confirm the web server reloads without service interruption.
Monitor with a post-renewal webhook
Configure a post-renewal hook in certbot via the --post-hook option or in the /etc/letsencrypt/renewal-hooks/post/ directory. This hook can send a notification to an alert channel to confirm renewal completed successfully. A prolonged silence on this channel itself becomes an alert.
Run certbot renew --force-renewal on a staging environment several weeks before your first certificates expire. With 47-day validity periods, the window between the first alert and actual expiration will be narrow. A forced test in advance takes a few minutes and eliminates this category of risk.
Going further
If you are starting with Let's Encrypt on a VPS, our article on SSL certificates with Let's Encrypt covers the initial setup and edge cases related to wildcards. For new infrastructure, Caddy deserves close attention: its native ACME protocol support completely removes the certificate management layer, with the web server handling it transparently.
