From today, new security certificates last at most 825 days, so three-year certificates are gone, while existing ones run to their dates. Automatic renewal makes the limit irrelevant; otherwise, check who receives the expiry warnings.

A shorter maximum, from today

The security certificate on your website, the file behind the padlock and the https, has an expiry date. From today, newly issued certificates can be valid for no more than 825 days, about 27 months.

Until yesterday the maximum was 39 months, which is why three-year certificates were common. They can no longer be issued.

Certificates issued before today keep their original dates. Nothing on your site changes this morning.

What changes is how often the renewal question comes up, and renewals are where certificates go wrong.

Why certificates expire at all

A certificate does two jobs. It encrypts what passes between the visitor and your site, and it confirms that the site belongs to whoever controls the domain.

That confirmation is only as fresh as the check behind it. Domains change hands, businesses close, and the rules for how checks are done improve over time.

Shorter lifetimes mean every certificate in use was checked reasonably recently, under reasonably current rules. Browser makers and the companies that issue certificates agreed this change last year.

There is a second reason. Cancelling a certificate early works unreliably in practice, so a shorter life also limits how long a wrongly issued one stays usable.

What changes and what does not

The fourth is the one to watch. A plan sold as three years now includes at least one new certificate along the way, and a new certificate has to be installed by someone.

Where renewals actually fail

Paying for a renewal is rarely the problem. Installing it is.

A renewed certificate is a new file. Until it replaces the old one on the server, the site keeps using the old one right up to its expiry, and the receipt in somebody's inbox protects nothing.

The second failure is coverage. Many businesses have more than one certificate: the main site, an online store or booking page on a subdomain, sometimes the mail server. Each has its own date.

The third is the warning email, which goes to whoever placed the original order. That may be a former developer, or an address at a domain the business no longer uses.

What an expired certificate looks like

An expired certificate is worse than having none. A plain HTTP page gets, at worst, a small Not secure label in Chrome's address bar; a page with an expired certificate gets a full-page warning instead of your site.

In Chrome it reads "Your connection is not private". The visitor has to click through technical-looking options to continue, and very few do.

Forms stop, the shop stops, and links shared that week lead to the same warning. The phone rings with customers asking whether you have been hacked.

A worked example

A propane delivery company lets customers order refills and pay their accounts through a portal on a subdomain of its website.

Its two certificates were bought for three years in early 2015, through the host. The renewal reminders went to the developer who had built the portal, who had moved on long before.

Both expired on a weekday in January, during a cold snap. Customers trying to order saw a full-page warning, and the office spent two days taking orders by phone.

The host replaced both with free certificates that renew automatically, covering the main site and the portal.

The hosting account's contact address became a shared office address, and a reminder now goes in the calendar each quarter to check the dates.

Automatic renewal makes the question disappear

Free certificates from Let's Encrypt last 90 days, and that short life is deliberate. They are designed to be renewed and installed by software, with no person involved.

On a host that supports them properly, the certificate renews itself every couple of months, and the 825-day rule never comes into it. The connection is encrypted exactly as well as with a paid certificate.

Many hosts now offer this as standard, at no charge. If yours does and your site is not using it, that is worth asking about this week.

When automatic renewal quietly stops

Automatic does not mean infallible. Each renewal depends on a fresh check that you still control the domain.

Moving the domain's DNS to a new provider, putting a security service in front of the site, or adding a rule that blocks the check can all make renewal fail without anyone noticing until the date passes.

So glance at the expiry date every few months anyway. Click the padlock in the address bar, open the certificate details, and look for the date it is valid until.

Who gets the warnings

Most certificate sellers and hosts send expiry warnings, usually a month or more ahead and again closer to the date. They are useful only if they reach somebody.

Find out which address they go to, and change it to a shared address that more than one person reads, at a domain the business controls.

Check the contact address on the hosting account while you are there, since the host's own notices about certificates go to it.

For any certificate that does not renew automatically, put the expiry date in two calendars, with a reminder a month before.

The counter-case

For many sites, today changes nothing.

A site already on free, automatically renewing certificates has no decision to make beyond confirming the renewals work. One that bought a three-year certificate last month keeps it to the end of its term.

Some organisations have reasons to buy paid certificates with more extensive identity checks, and the shorter limit simply means renewing them more often.

For everyone else, the advice is what it was yesterday, only more pressing: renew automatically where you can, and make sure the warnings reach someone where you cannot.

The check

  1. Click the padlock and note the expiry date.
  2. List every certificate the business uses.
  3. Ask your host about automatic free certificates.
  4. Find where expiry warnings go.
  5. Change that address to a shared one.
  6. Calendar any manual renewals a month ahead.
  7. Check the dates every few months anyway.

Step two is the one most businesses miss, because the certificate that expires unnoticed is rarely the one on the main site. It is the one on the booking subdomain or the mail server.

Why the padlock matters more with every month this year is covered in Chrome will mark every HTTP page not secure in July.

Frequently asked questions

What changes about certificates from today?

Newly issued certificates can be valid for at most 825 days, about 27 months, down from 39. Three-year certificates can no longer be issued; existing ones keep their dates.

Does my current certificate stop working?

No. A certificate issued before today runs to its original expiry date. The new limit only affects certificates issued from today onwards.

Why do certificate renewals go wrong?

Usually because the renewed certificate is never installed, a second certificate on a subdomain is forgotten, or the expiry warnings go to someone who has left.

What happens when a certificate expires?

Visitors see a full-page warning instead of your site, which is worse than a plain HTTP label. Forms and checkouts stop until a valid certificate is installed.

Are free certificates affected by the limit?

No. They already last 90 days and are built to renew automatically. On a host that supports them properly, the 825-day rule never comes into it.

Who should receive expiry warnings?

A shared address that more than one person reads, at a domain the business controls, never a former developer or a single employee's personal inbox.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure when your certificate expires?

Send us your domain. We will list every certificate you use, its expiry date, and where the warnings should go.

Start a Conversation