On December 2, 2025, Let’s Encrypt announced staged reductions in certificate lifetimes, moving toward 45-day validity by 2028. The announcement followed the CA/Browser Forum’s broader decision to shorten the maximum validity of publicly trusted TLS certificates. It reinforced the importance of dependable renewal automation.
Keep HTTPS working through each renewal
A TLS certificate helps a browser establish an authenticated, encrypted connection. Expiry is part of that trust process. Shorter validity means more frequent replacement; it does not shorten a domain registration or the period for which a hosting service is purchased.
Let’s Encrypt explained that shorter lifetimes limit how long a misissued certificate or compromised key can remain useful. They also encourage automation instead of depending on an administrator remembering every renewal.
Understand which schedule applies
The December plan distinguished certificate profiles, with the default profile moving through an intermediate lifetime before reaching 45 days. The CA/Browser Forum set a separate industry-wide maximum. These were related developments, not one date on which every existing certificate would stop working.
For implementation, consult the issuer’s current schedule and the documentation for the renewal client. Automation should account for actual validity or supported renewal information instead of a fixed interval designed for older certificates.
Verify the complete renewal process
Identify the system requesting certificates and the service presenting them to visitors. A successful renewal must be followed by installation and use. Where a site has a proxy and an origin, determine which certificate belongs to each connection.
Maintain the renewal client and confirm that domain-control validation remains possible after DNS, routing or access changes. Review recent renewal results, the certificate actually served and the alert path for failures. These checks complement each other: a scheduled task existing does not prove that a replacement certificate is in use.
Customers using a managed service should confirm who owns renewal and exception handling. Those managing their own servers should review automation before changing certificate profiles. The objective is continuity of HTTPS across repeated renewals, with a clear response when validation or installation fails.
Plan certificate maintenance as an ongoing operating process. The relevant measure is not just how long a certificate lasts, but whether the next valid certificate reaches the right service in time.
For a website owner, reliable certificate handling helps keep visitors from meeting an unexpected trust warning during an enquiry or purchase. Nuagerie can help clarify which domains and services need coverage and who is responsible for issuance, installation and renewal follow-up. Our SSL certificate offering provides a starting point for discussing the certificate requirements of the actual service, rather than choosing from a product name alone.
Prepare a list of the domains or subdomains involved and identify the hosting provider or administrator responsible for each. If you already use Nuagerie, send that outline or a specific certificate warning through the client area. It lets the team distinguish certificate selection from a renewal or installation issue and agree on the next check without requesting private keys in an initial enquiry.
