GlossarySecurity and reputation
TLS certificate
Definition
A TLS certificate is a file signed by a certificate authority attesting that a public key belongs to the holder of a domain name. It is what makes a browser's encrypted connection possible, and its expiry is what puts a full-screen warning in front of your visitors.
A lifetime that keeps getting shorter
A certificate has an end date, and it moves closer with every revision of the industry rules. Since 15 March 2026, the maximum lifetime of a public certificate is 200 days. The schedule adopted by the CA/Browser Forum brings that to 100 days in March 2027, then to 47 days in March 2029. Automatic renewal is no longer a convenience; it is the only way to keep up.
For an agency, the certificate is the most visible thing that can go wrong in a portfolio. An expired domain can go unnoticed for weeks; an expired certificate shows up within the second, to every visitor, behind a screen announcing that the site is unsafe. And nothing says the date will fall on a working day.
The fields you read first
The certificate a site actually serves, reduced to what matters.
Subject: CN = example.com
Subject Alt Name: DNS:example.com, DNS:www.example.com
Issuer: O = Let's Encrypt
Not Before: 2026-09-01 00:00:00 UTC
Not After: 2026-11-30 23:59:59 UTC“Subject Alt Name” is the decisive field: it lists the names covered, and a current browser no longer looks at “CN” at all. A certificate covering the bare name but not “www” produces a warning on a good half of the visits.
The usual mistake
Relying on automatic renewal without ever checking that it happens. The mechanism breaks quietly — a firewall rule, a config file moved, a domain removed from the server — and you hear about it from the client, on a Sunday.
How to avoid it: Monitor the end date of the certificate the site actually serves, not the configuration meant to renew it. The only proof that a renewal works is a certificate whose date has genuinely moved.
Source: Maximum lifetimes are set by the CA/Browser Forum Baseline Requirements. Its ballot SC-081, adopted in April 2025, set the schedule: 200 days from 15 March 2026, 100 days from 15 March 2027, 47 days from 15 March 2029.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.