PDF guide + Python toolkit · zip · One-time

The 100-Day Certificate Playbook

Put every TLS certificate you manage on a plan before public certificate lifetimes drop to 100 days on 15 March 2027, and to 47 days in 2029.

By Keith Ransom, Outset Solutions

$39 one-time · instant download

21-page PDF guide plus two working Python tools, delivered as one zip file.

Buy now: $39 → Free: get the certificate scanner

Running an MSP? Email [email protected] about an MSP team licence.

Why now

In 2025 the CA/Browser Forum passed Ballot SC-081, which shortens how long a publicly trusted TLS certificate can last. The 200-day limit is already live. The next step arrives on 15 March 2027.

From	Maximum lifetime	Renewals per certificate per year
15 March 2026	200 days	2
15 March 2027	100 days	4
15 March 2029	47 days	8

A client with 12 public certificates goes from about 24 manual renewals a year today to 96 by 2029. Every missed one is a VPN that will not connect or a website that shows a security warning.

Who it is for

MSPs, and IT teams of one to ten people, who look after firewalls, VPN portals, Windows and Linux servers, NAS units, printers and the odd line-of-business app, and who still renew certificates by hand.

What is inside

Why this is urgent now: the SC-081 timeline and what it costs you in hours.
Find every certificate you own: Certificate Transparency searches plus a network scan.
Triage: sort every device into one of four automation paths.
Public certificates with ACME: certbot, Caddy, win-acme for IIS, and central DNS-01 renewal with deploy hooks for firewalls and appliances.
A private CA for internal systems: step-ca setup, lifetimes, root distribution by Group Policy or MDM, and protecting the CA.
Monitoring that catches failures: check what each endpoint actually serves, and alert Slack, Teams or Power Automate.
The 30-day rollout plan: a week-by-week checklist with a clear definition of done.
For MSPs: how to package certificate lifecycle management as a billable service.

The toolkit

cert_inventory.py scans your hosts and ports and reports every certificate's issuer, names and days to expiry, including self-signed and private-CA certificates, on any endpoint that speaks TLS 1.2 or newer. Output to a table, CSV or JSON, with exit codes for scheduled jobs. Free download.
cert_monitor.py is a small FastAPI service that rescans on a schedule, serves the results over HTTP, exposes a health check, and posts alerts to a webhook. Included with the guide.

Both run with uv on Python 3.10 or newer, need no pip install (uv fetches the dependencies), and only read certificates. They never change device configuration.

Read first: Your certificates expire twice as often from March 2027. Here is the maths.

Get the playbook: $39 →

Educational content. Vendor features change with firmware releases; confirm against your vendor's documentation before production changes.