Website security · checked 14 October 2026
SSL certificate expiry check
Every HTTPS website needs a certificate, and every certificate has an end date. When it passes, visitors get a full-page "Your connection is not private" warning and most leave. The maximum lifetime of a certificate is now shrinking in steps, so a once-a-year manual renewal no longer works.
Our free check reads public Certificate Transparency logs to show when your current certificate expires, who issued it, and whether it looks renewed automatically.
The new schedule
The CA/Browser Forum, the group of browser makers and certificate authorities that sets the rules, voted to cut the maximum lifetime of public TLS certificates:
| Certificates issued from | Maximum lifetime | Renewals a year (at least) |
|---|---|---|
| Before 15 March 2026 | 398 days | 1 |
| 15 March 2026 | 200 days | 2 |
| 15 March 2027 | 100 days | 4 |
| 15 March 2029 | 47 days | 8 or more |
The first 200-day certificates, issued in mid-March 2026, run out from about 1 October 2026. A Sectigo executive has warned that this is when businesses still renewing by hand will start to see outages, because a renewal they used to do once a year now comes round twice as often and is easy to miss.
Automatic or manual?
Certificates from Let's Encrypt, Google Trust Services, ZeroSSL, Cloudflare, Amazon (AWS Certificate Manager) and cPanel AutoSSL are almost always renewed by software using the ACME protocol, and usually last 90 days or less. If yours comes from one of these, you're probably fine, as long as renewal keeps working.
A certificate that lasts close to a year and comes from a commercial certificate seller was usually bought and installed by hand. That is the setup that will break.
What a small business should do
- Check when yours expires with the free check above, and put the date in a calendar now.
- Switch to automatic renewal. Most web hosts include a free auto-renewing certificate (often called "free SSL", "AutoSSL" or "Let's Encrypt"); turn it on. If you run your own server, use an ACME client such as certbot. Cloudflare and AWS renew theirs for you.
- If you must buy a certificate, ask the seller whether it supports ACME so renewals are automatic.
- Find every certificate, not just the website: online shops, booking pages, mail servers and internal tools can each have their own.
- Get an alert before expiry. Automatic renewal can fail silently (a changed DNS record or firewall is enough). Our monitoring will email you before a certificate expires.
Sources: CA/Browser Forum Ballot SC-081; TechRadar: why October 1 2026 could be the day SSL/TLS certificates break the internet; 365i: SSL certificates move to 200-day validity, March 2026.