In 2025, the world of SSL certificates is about to undergo a major shift — again.
The SSL/TLS ecosystem is preparing for a move toward short-lived certificates, with the next big milestone being the introduction of 47-day certificate validity periods. This marks a significant drop from the current 90-day standard commonly seen with free CAs like Let’s Encrypt and an even steeper reduction from the 398-day maximum for commercial certificates.
But what’s driving this change? And how should businesses, developers and IT teams prepare?
Let’s break it down.
Why the Shift to 47-Day SSL Certificates?
There are two main forces behind this transition:
- Improved Security Through Shorter Lifecycles
The shorter a certificate’s lifespan, the lower the risk window if it’s compromised. With short-lived SSL certificates, issues like key compromise or mis-issuance are far less damaging because the certificate expires quickly. - Industry Push Toward Automation
Certificate renewal has traditionally been a manual, error-prone process. As automation tools (like ACME clients) become the norm, the argument against shorter lifespans weakens. In fact, automation is now seen as essential.
This change is being supported — and in some cases, led — by major players in the browser and CA ecosystem, including Google Chrome and Let’s Encrypt.
From 398 to 90… to 47 Days
Historically, SSL certificates were valid for up to 2 or even 3 years. That changed in 2020, when browser vendors capped lifetimes at 398 days. The goal was tighter control and faster adoption of new security standards.
Let’s Encrypt then pioneered the 90-day model and now, the next wave is 47-day validity, with automatic renewal mechanisms renewing certs every 30 days or less. This provides a buffer to handle failed renewals while maintaining high security.
What it Means for Site Owners
If you’re managing your website or online store, here’s what you need to consider:
- Manual renewals are no longer viable. Renewing certificates every 47 days is not sustainable by hand.
- Automated certificate management is now essential. If you’re not using a tool like Certbot, acme.sh, or a managed SSL service, it’s time to implement one.
- Downtime risks increase without automation. Missed renewals could lead to expired certificates, browser errors and lost trust from visitors.
- Expect browser enforcement soon. While 47-day certificates are not yet a universal requirement, adoption is accelerating.
What IT Teams Should Do Now
If you’re part of a development or infrastructure team, preparation is key:
- Audit your current certificate deployment strategy.
Know which domains, subdomains and environments use SSL, and how certs are issued and renewed. - Implement ACME-based automation where possible.
Use tools like Certbot, win-acme, or EFF’s Dehydrated. Many hosting providers and CDNs offer built-in automation. - Schedule early renewals (e.g., every 30–35 days).
This ensures a safety buffer and avoids expiry-related outages. - Integrate monitoring.
Set up monitoring tools to alert you if a certificate is nearing expiry or if a renewal fails silently. - Review CA options.
Some commercial certificate providers are slow to adopt automation-friendly options. Consider switching to vendors that offer ACME support or fully managed renewal.
Will all Certificates be 47 Days?
Not necessarily — at least not right away. This shift is expected to start with ACME/automated certificates and gradually become the default for most providers, especially for DV (Domain Validated) certs. Extended Validation (EV) and Organization Validated (OV) certificates may still have longer lifespans for now, due to stricter issuance requirements.
However, the industry trend is clear: Short-lived, auto-renewing SSL is the future.
Final Thoughts
The move to 47-day SSL certificates is a major step toward a more secure, automated internet. While it introduces new challenges, especially for organizations relying on manual processes, it ultimately pushes the ecosystem toward greater resilience and trust.
The key takeaway? Automation isn’t optional anymore — it’s foundational.