What will change with the shortening of SSL certificate validity periods? | 10 things to check internally
Due to the shortening of SSL certificate validity periods, website certificates will need to be renewed approximately every three months starting in March 2027, and approximately every one and a half months starting in March 2029. Companies that rely on the memory or calendar entries of the person in charge for renewals are advised to now confirm "who is renewing which certificate and how."
What does shortening the validity period of an SSL certificate mean?
SSL certificates (electronic certificates that prove a site is authentic and encrypt communications) have an expiration date. Renewal, in this context, refers to the process of switching to a new certificate before the current one expires
The rules for certificate validity periods are set by the industry group "CA/Browser Forum," which includes certificate authorities (businesses that issue certificates) and browser developers. InApril 2025, this group passed a proposal to gradually shorten the validity period. Depending on the certificate issuance date, the maximum validity period will vary as follows:
| Certificate issuance date | Longest validity period | Approximate update frequency |
|---|---|---|
| Until March 14, 2026 | 398 days | Once a year |
| From March 15, 2026 | 200 days | Twice a year |
| From March 15, 2027 | 100 days | 4 times a year |
| From March 15, 2029 | 47 days | More than 8 times a year |
Don't rely on others to renew your SSL certificate
If this task is performed once a year, the burden is minimal and the impact on operations is limited. However, if it is performed eight times a year, the current operational method will suddenly place a heavy burden on the person in charge
As a countermeasure, we recommend deciding on the following three points in advance: First, implement an automatic update mechanism. Second, implement monitoring that can detect when automatic updates fail. Third, designate a person to handle issues when they occur
Reasons why an expired SSL certificate can cause problems
A warning appears on the customer's screen, making it difficult for the company to notice
When you open a website with an expired certificate, Google Chrome displays a warning message saying, "Your connection is not private." Many visitors close the page and leave at this point
The tricky part is that it's customers and business partners who see the warnings. Since internal staff don't necessarily check the company website every day, sometimes the problem only becomes apparent after a decrease in inquiries or purchases has occurred, or through external contact
Services other than the website may also be affected
Certificates aren't just used on website screens. They're also used in communications between smartphone apps and servers, in integrations with external services like payment and inventory management, and on login screens for internal systems
When a certificate expires in these background communications, it manifests as problems such as "the app won't load" or "order data won't be received," without even displaying a warning screen. It takes time to realize that the cause is the certificate, which can delay recovery
Update work tends to depend on the individual in charge
For tasks performed only once a year, it's difficult to keep a procedure manual, and the process tends to be known only by specific individuals. Furthermore, as the frequency of updates increases, the workload becomes concentrated on those individuals
When an employee leaves the company or is transferred, it can become difficult to remember which certificates were purchased where and which server they were installed on
Four measures to shorten the validity period
Create a list of certificates used within your company
First, list all the certificates your company uses. List them one per domain, including your corporate website, e-commerce site, campaign sites, app servers, internal systems, etc
Each row should include the supplier, expiration date, person responsible for renewal, and whether it's an automatic renewal. Creating the management sheet can be done by interviewing the person in charge or the contractor, and can be done even by someone who isn't an engineer
Check if you are eligible for automatic renewal
Free certificates (such as Let's Encrypt) are typically automatically renewed by many server providers. On the other hand, "Organization Validation (OV)" and "Extended Certificates" that verify the existence of a company may require application and document verification each time they are renewed
Please check with your supplier or contractor to determine which category your company's certificate falls under
External monitoring of expiration dates
Automatic renewal may stop due to configuration changes or server migrations. To ensure you notice when this happens, it's a good idea to implement monitoring that periodically checks the remaining days on the certificate from an external source
We will set it up so that both the person in charge and the contractor receive a notification when the number of remaining days falls below a certain level
Determine who to contact and how to communicate with them
Even if a notification comes from monitoring, it's meaningless if no one takes action. Designate who will receive the notification, who will perform the task, and who will take over if someone is unable to perform the task, and write them down in a list
Possible scenarios
The following are hypothetical scenarios created by our company based on common situations
One e-commerce company had its corporate website and e-commerce site certificates automatically renewed and managed by the web design company. However, a special site created by a different person for the year-end sale required manual purchase of a corporate authentication certificate
The person in charge of launching the special website was subsequently transferred, and the update notification emails remained in their email address without anyone checking them. On the morning of the first day of the sale, we received reports via social media that "warnings are appearing and the site cannot be opened," and it took us half a day to identify the cause and reissue the site
The company later revised its policy by creating a list of certificates, changing the notification destination for purchases to a shared address, and implementing external monitoring of the remaining days
10 items to check using the self-assessment checklist
Please check with the person in charge or the contractor, starting with the items you are unsure about
| No. | Check items | Yes / No / I don't know |
|---|---|---|
| 1 | We have a complete list of all the certificates we use, organized by domain | |
| 2 | The list also includes domains that are not normally used, such as special sites and old sites | |
| 3 | You can see the expiration date of each certificate | |
| 4 | You can see whether each certificate is automatically renewed or manually renewed | |
| 5 | There is a procedure manual for manually renewing certificates | |
| 6 | The renewal notification email will be sent to a shared email address, not to an individual user | |
| 7 | There is a system in place to monitor the remaining days of the certificate externally and send notifications | |
| 8 | There is a designated person in charge when the notification is received, and a substitute person has also been designated | |
| 9 | We also have a grasp of the certificates used to integrate with apps and our business partners' systems | |
| 10 | We are in discussions with our contractors based on the premise that updates will be made four times a year starting in March 2027 |
List of questions for the person in charge/contractor
If you have entrusted server management to a production company or operations company, please use the following questions as they are
| question | What we can learn from this question |
|---|---|
| How many certificates does our company have, and what are their expiration dates? | Does the contractor have a complete understanding of the situation? |
| Which certificates are not set to automatically renew? | Areas where manual work remains |
| When an automatic update fails, who will notice and how? | Whether or not there is surveillance |
| Is renewal work included in the contract? Will the cost remain the same even if the number of renewals increases? | Cost forecasts from 2027 onwards |
| If an expiration occurs at night or on a holiday, how quickly can you respond? | Response system and time slots |
Things to be aware of when renewing an SSL certificate
The contract period and the validity period are different things.Even if you purchase a certificate under a multi-year contract, the maximum validity period will be short, such as 200 days or 100 days.you will need to reissue the certificate multiple times during the contract period, please check whether the vendor will automatically reissue it or if you will have to handle the procedure yourself.
Corporate certifications and EV certificates may require review and document verification each time they are reissued. Companies that require internal stamping or approval should also factor in the time required for these procedures
Automatic renewal settings may not be carried over before or after switching server providers or migrating to the cloud. We recommend including a note in your migration plan stating, "Verify automatic certificate renewal after migration."
Additionally, smartphone apps and systems of business partners may use your company's certificates to communicate. In this case, replacing the certificate may require the other party to change their settings, so please check with the app developer or business partner in advance
FAQ
Will the expiration dates of certificates I already have also be shortened soon?
No. The reduction is applied based on the certificate issuance date. Existing certificates remain valid for the period they were issued for. The new limit will apply from the next time you renew or reissue a certificate
If I'm using a free certificate, is no action required?
Many free certificates are originally valid for about 90 days and are operated on the assumption of automatic renewal. However, if you are unaware that automatic renewal has stopped, there remains a risk of expiration. Monitoring and confirmation by the person in charge are necessary
Why is the validity period shortened?
This is to prevent outdated certificate information from being used for extended periods and to allow for the rapid replacement of certificates when problems are found. Apple and Google, among others who develop browsers, have been supporting this trend
What should I do if there are no engineers in the company?
First, use the checklist in this article to assess your current situation, and ask your production company or server provider any questions you have about any items you don't understand. You can also consider entrusting all server operations, including certificate renewals, to a specialized company
Related services of Beyond Co., Ltd
Beyond provides a comprehensive service that covers everything from cloud and server design and construction to operation and maintenance
Our fully managed service provides 24/7/365 manned server monitoring by engineers from our Japan and Canada bases. In the event of a failure, we handle everything from root cause investigation and recovery to preventative measures. Before service releases or peak seasons, you can also utilize our Secure Launch service (pre-release/pre-peak season diagnostics) to comprehensively identify operational risks
If you want to easily start monitoring your website in-house, our website monitoring tool "Appmill" supports SSL certificate expiration checks. Please check our official website for the latest details and pricing of each service
summary
- Use the 10-item checklist in this article to list your company's certificates by domain
- For items marked "I don't know," use the question list to confirm with the person in charge or the contractor
- By March 2027, when the system will be operational for 100 days, we will have three key elements in place: automatic updates, external monitoring, and dedicated personnel to handle the updates
If you would like to discuss server operations, including certificate management, please contact us through the inquiry form
The person who wrote this article
About the author
