Your certificates are about to renew eight times a year.
CA/Browser Forum ballot SC-081v3 shortens public TLS certificates to 100 days on 15 March 2027 and to 47 days on 15 March 2029. Put in your own numbers to see the workload, then decide what to automate first.
Your renewal workload
Each certificate is renewed about 2 times a year today, 4 times from March 2027 and 8 times from March 2029. Nothing you type here leaves your browser.
| Period | Maximum lifetime | Renewals a year | Hours a year |
|---|---|---|---|
| Today | 200 days | 40 | 20 |
| From 15 March 2027 | 100 days | 80 | 40 |
| From 15 March 2029 | 47 days | 160 | 80 |
The figures follow what you type. With automated renewal the manual count is zero; the work left is checking that each renewal happened.
Before 15 March 2027
Three things to have in place.
Know every certificate
Certificate Transparency logs list every public certificate issued on your names. A scan of your domains shows which listener serves which one, and when each expires.
Renew without a person in the loop
ACME renews and installs a certificate on the server itself, weeks before expiry, and retries on its own. At eight renewals a year, a calendar reminder is no longer a plan.
Keep proof that it worked
A record that each certificate was renewed before it expired is what an auditor asks for under NIS2 and DORA. The monitoring that catches a missed renewal also writes that record.
See which of your listeners have no automated renewal.
The free check reads your certificates from the outside and tells you how often each one has been renewed, so you know where the work will land first.