Infrastructure Automation · Article 2

Your Certificates Expire Twice as Often From March 2027. Here Is the Maths.

By Keith Ransom, Net Integrate LLC

If you renew TLS certificates by hand once a year, that habit has a deadline. On 15 March 2027, the longest a publicly trusted certificate can last drops to 100 days. By 2029 it drops to 47.

What changed

In 2025 the CA/Browser Forum, the body whose rules every public certificate authority follows, passed Ballot SC-081. It shortens certificate lifetimes in steps, and it also shortens how long a CA can reuse its proof that you control a domain.

From	Maximum certificate lifetime	Domain validation reuse
15 March 2026	200 days	200 days
15 March 2027	100 days	100 days
15 March 2029	47 days	10 days

Two more things make reminders a weak safety net. Let's Encrypt stopped sending expiry emails in 2025. And many commercial CAs now sell multi-year subscriptions that still issue short certificates underneath, so someone still has to install each one.

What it costs an MSP

Take one client with 12 public-facing certificates: website, webmail, customer portal, VPN, and a handful of others. At 20 minutes per renewal, including install and testing:

Period	Renewals per year	Hours per year
Now (200 days)	about 24	8
From March 2027 (100 days)	about 48	16
From March 2029 (47 days)	about 96	32

Multiply by your client count. That is the cost when everything goes right. When one renewal is missed, the VPN stops connecting or the website shows a security warning, usually on a weekend.

Step one: find every certificate you own

You cannot automate what you have not found, and the list is always longer than people expect. Use two sources:

1. Certificate Transparency logs. Every public certificate is logged. Search your domains at crt.sh (for example %.example.com) to see every logged certificate issued for them.
2. A network scan. Ask each host and TLS port what certificate it actually serves. This finds the self-signed and private ones that CT logs never see: firewall admin pages, NAS units, printers, iDRAC and iLO. The scanner below speaks TLS 1.2 or newer and does not do STARTTLS, so older firmware and mail or LDAP ports show as UNREACHABLE; check those by hand with openssl s_client.

For the second, here is a free scanner. List your endpoints in a text file, one per line:

www.example.com
vpn.example.com:10443
10.10.0.1:443,fw.example.local
mail.example.com:993

Then run it with uv:

uv run cert_inventory.py targets.txt --warn-days 30 --csv inventory.csv

You get every certificate sorted by urgency, with issuer, names and days left, plus a CSV for your records. It exits non-zero when anything is expiring, so it drops straight into a scheduled task.

Download the free scanner

Then what

Once you have the list, every endpoint falls into one of four paths: devices that can renew themselves with ACME, devices you can push certificates to by API, devices you can put behind a proxy, and the few that need a long-lived certificate from your own private CA. Public names go to a public CA. Internal names go to a private one.

The 100-Day Certificate Playbook walks through all four paths with copy-and-paste configurations, a step-ca private CA setup, a FastAPI monitoring service that alerts Slack, Teams or Power Automate, and a 30-day rollout plan.