Certificate lifetimes are shrinking by rule. Since 15 March 2026 a publicly trusted TLS certificate can last at most 200 days, down from 398. From 15 March 2027 the limit is 100 days, and from 15 March 2029 it is 47. So we read the certificate of every domain in the top 10,000 on 8 October 2026 to see who issues them, how long they last, and how far the web already is from the 47-day world.
- Google Trust Services now issues more certificates than Let's Encrypt: 26.5% against 21.6% of the 8,184 we read. Most of that lead is Cloudflare: 80% of the websites with a Google certificate are served through Cloudflare.
- Half the top 10,000 is already inside 2027's limit. 50.7% of certificates last 100 days or less, almost all of them the 90-day kind that Let's Encrypt and Google issue.
- 18.1% still run a certificate longer than 200 days, issued before the new limit. 839 of them expire in the first quarter of 2027, so the rule will show up on most of these sites within months.
- 47 days is still rare: 0.6% of certificates are that short. The bulk are 30-day certificates from Fastly's own authority (arxiv.org, time.com, costco.com, yale.edu), and digicert.com itself runs a 47-day certificate.
-
Broken certificates are rare on real websites: 41 of 6,401 websites (0.6%) gave a certificate error at the address we checked, almost always the bare domain.
-
An authority can fall in days. On 17 October Chrome and Firefox blocked eight weak eMudhra keys within hours, and five days later the company said it would leave the business. 10 of the top 10,000 used it when we checked; three still did on 4 November.
| What we found | Certificates | Share |
|---|---|---|
| Domains that answered TLS on port 443 (of 10,000) | 8,190 | |
| Certificates we could read | 8,184 | 100% |
| Lifetime 47 days or less (2029's limit) | 53 | 0.6% |
| 100 days or less (2027's limit) | 4,148 | 50.7% |
| 101 to 200 days (2026's limit) | 2,554 | 31.2% |
| Longer than 200 days (almost all issued before 15 March 2026) | 1,482 | 18.1% |
| Negotiated TLS 1.3 (share of the 8,190 that answered) | 6,906 | 84.3% |
Who issues the web's certificates
| Issuer | Certificates | Share | Median lifetime |
|---|---|---|---|
| Google Trust Services | 2,168 | 26.5% | 90 days |
| Let's Encrypt | 1,770 | 21.6% | 90 days |
| DigiCert | 1,190 | 14.5% | 199 days |
| Amazon | 1,127 | 13.8% | 198 days |
| GlobalSign | 605 | 7.4% | 199 days |
| Sectigo | 498 | 6.1% | 199 days |
| GoDaddy | 151 | 1.8% | 198 days |
| HARICA | 89 | 1.1% | 199 days |
The free authorities, Google Trust Services and Let's Encrypt, issue 48% of the certificates between them, almost all (94%) for 90 days. Google's lead comes from Cloudflare: of the websites served through Cloudflare, 65% carry a Google certificate, and of the websites with a Google certificate, 80% are behind Cloudflare.
The paid authorities have already moved to the new limit. DigiCert, GlobalSign, Sectigo and HARICA now issue for 199 days, Amazon and GoDaddy for 198: a day or two under the 200-day maximum.
The biggest sites are the exception to the free-certificate trend. In the top 1,000, DigiCert is the most common issuer (21.1%, ahead of Google at 20.1% and Let's Encrypt at 17.2%), and the median certificate lasts 198 days. From rank 5,001 to 10,000, Google issues 30.4% and Let's Encrypt 23.1%, and the median certificate lasts 90 days.
How long certificates last now
| Lifetime | Certificates | Share |
|---|---|---|
| 47 days or less | 53 | 0.6% |
| 48 to 90 days | 4,005 | 48.9% |
| 91 to 100 days | 90 | 1.1% |
| 101 to 200 days | 2,554 | 31.2% |
| 201 to 398 days | 1,468 | 17.9% |
| More than 398 days | 14 | 0.2% |
The rule works as written. Every certificate longer than 200 days that we found was either issued before 15 March 2026 or doesn't come from a publicly trusted authority. Only 13 long certificates were issued after that date: 11 from Russia's national certification authority (used by Sberbank, T-Bank and other Russian banks and companies), which the main browsers don't trust, and two signed by unknown authorities.
The long certificates are running out on their own. Of the 1,482 certificates issued for more than 200 days, 548 run out in the last quarter of 2026 and 839 in the first quarter of 2027. A replacement issued before 15 March 2027 can last 200 days, and one issued after that date only 100.
Who is already at 47 days or less
53 certificates (0.6%) last 47 days or less. 33 of them are 30-day certificates from Certainly, the authority run by the CDN company Fastly, on sites such as fastly.net, arxiv.org, time.com, costco.com, yale.edu, wikihow.com and newsweek.com. Five DigiCert certificates last exactly 47 days, digicert.com's own among them, and six Let's Encrypt certificates last 45 days.
Broken certificates: rare on websites, common on machine hosts
| Result | Domains | Share |
|---|---|---|
| Verifies | 7,926 | 96.8% |
| Name doesn't match the domain | 206 | 2.5% |
| Self-signed or unknown authority | 27 | 0.3% |
| Expired | 20 | 0.2% |
| Chain didn't verify (missing intermediate or untrusted root) | 11 | 0.1% |
3.1% of the domains that answered failed verification (253, not counting the 11 chains we couldn't verify), but most
of those failures (213 of the 253) are on CDN, API and tracking hosts nobody types into a browser. Among the 6,401 real
websites that answered TLS, 41 (0.6%) gave a certificate error: 36 name mismatches, 2 expired certificates and 3
from authorities browsers don't trust. 38 of the 41 were read at the bare domain. On 8 October 2026 the bare address
(without www) gave a name-mismatch warning at netease.com, virginia.edu, novell.com and privacyshield.gov, among others.
Some machine hosts have lived with a broken certificate for years. ezviz7.com, number 14 in the list, has no website
(its homepage didn't answer), but its www address served a GlobalSign certificate that expired on 11 November 2020.
The public Certificate Transparency logs show no newer certificate for the name.
Expiry is a different matter: 411 certificates expire within 30 days of our check and 25 within a week. With 90-day certificates that's normal, as long as renewal is automated. It's when renewal stops working that sites go down.
When the authority itself fails: eMudhra
Nine days after our check, one of the authorities in our data had the worst week a certificate authority can have. On 17 October 2026 a researcher known only as Wayne told the browser makers that the private keys of eight intermediate certificates from eMudhra, an Indian authority, could be worked out from the public certificates. Each key should have been a random 384-bit number. Each was a number below 256, and one was simply 4. They dated from April 2025. Six of the eight were for websites, so anyone could have forged a trusted certificate for any site. It didn't take an expert either: Mozilla's Dennis Jackson tried local AI agents, and they recovered a key on the first attempt from a simple prompt.
Browsers moved in hours. Chrome blocked the keys 1 hour 40 minutes after the report, with no update or restart, and Firefox followed the same night. Apple followed on 19 October and Microsoft on 20 October. Google found no website certificates from these intermediates in the public Certificate Transparency logs, so the block took no site down, and there's no public evidence that anyone abused the keys.
The damage came next. Chrome and Mozilla dropped the root above the intermediates, emSign ECC Root CA - G3, which left about 30,000 legitimate certificates needing a new home (eMudhra's estimate). On 22 October eMudhra said it would leave the TLS certificate business altogether.
10 domains in our list carried an eMudhra certificate on 8 October, all of them Indian public bodies, among them uidai.gov.in (the Aadhaar ID authority, rank 1,440), indiapost.gov.in and scholarships.gov.in. We read them again on 4 November:
| On 4 November | Domains | Which |
|---|---|---|
| Moved after the report | 5 | uidai.gov.in, nha.gov.in and indiapost.gov.in (to Sectigo), kerala.gov.in (Let's Encrypt), wcd.gov.in (ZeroSSL) |
| Had moved just before it | 2 | cybercrime.gov.in and ernet.in (Let's Encrypt, 14 and 15 October) |
| Still on eMudhra | 3 | scholarships.gov.in, lsgkerala.gov.in, udyamregistration.gov.in |
A certificate's date can't tell us why a site changed, and kerala.gov.in's old certificate was running out that week anyway. The three that stayed chain to eMudhra's other root, emSign Root CA - G1, which Mozilla has kept for now and Google is still reviewing. eMudhra says it will stop issuing from that one too, so they'll have to move as well.
That's the best argument for automated renewal we've seen this year. eMudhra said about 97% of those 30,000 certificates came through ACME, the protocol renewal tools use, where changing authority can be as small as changing one address. A site that renews by hand has to find a new authority, get validated and install the certificate on someone else's schedule.
TLS versions
84.3% of servers negotiated TLS 1.3 and 15.6% TLS 1.2. Our client, like current browsers, offered nothing older, so a server stuck on TLS 1.0 or 1.1 would have failed the handshake and isn't counted here.
Check your own certificate
- Open your site in a browser, click the icon left of the address and look at "Certificate": the issuer and the "Valid to" date.
- Or paste the address into UpWatchr's HTTP Status Checker. It shows the issuer, the expiry date and the days left, plus the status code, redirects and headers.
- Check the bare domain too (
example.com, not onlywww.example.com): that's where we found most of the warnings.
If your renewal is automated, shorter lifetimes change nothing for you. If someone renews a certificate by hand once a year, they will be doing it every three months by 2027.
How we tested
| Sites | The Tranco list of the top 10,000 domains (list K9Z7W, October 2026) |
| When | 8 October 2026, from one connection in Poland |
| Method | One TLS handshake per domain on port 443 (the domain, else www.), verified against the Windows root store. When verification failed we read the certificate again without verifying, to keep its issuer and dates |
| Counted | 8,190 domains answered; 8,184 certificates had readable dates. Lifetime = the certificate's own notBefore to notAfter |
| Websites | A domain whose homepage answered with an HTML page in the same week's crawl of the same list (6,459; 6,401 of them answered TLS) |
| Crawler | One handshake per domain; the robots.txt and file fetches of the same crawl used an honest user agent with a contact page |
| Re-check | On 4 November 2026 we read the 10 eMudhra domains again, one handshake each, without verifying. cybercrime.gov.in's bare address didn't answer, so it was read at www. |
| Limits | "Chain didn't verify" means our client couldn't build a chain to a trusted root: a missing intermediate (which browsers can often fetch themselves) or a root browsers don't trust (4 of the 11 are Russia's national authority). Each domain counts under the first error the check reported, so a certificate that is both expired and mismatched counts as a mismatch. Our client offered TLS 1.2 and 1.3 only |
Download the data: tls.csv (every domain that answered TLS, 8,190: issuer, lifetime, days left, verification, TLS version) · emudhra-recheck.csv (the 10 eMudhra domains on 8 October and 4 November) · the CSV behind each chart : u2-issuers.csv, u2-lifetimes.csv.
FAQ
How long is an SSL certificate valid in 2026? At most 200 days for a certificate issued on or after 15 March 2026. Certificates issued before that date could last up to 398 days, and 18% of the ones we found still do.
When do SSL certificates become 47 days? The CA/Browser Forum's schedule: 200 days from 15 March 2026, 100 days from 15 March 2027, 47 days from 15 March 2029. Today only 0.6% of certificates on the top 10,000 domains are that short.
What happens when an SSL certificate expires? Browsers show a full-page warning instead of the site, and apps and scripts that call it fail. Of the 6,401 websites we checked, 6 served an expired certificate (on 2 that was the only error; on the other 4 the check stopped at an earlier one, such as a name mismatch).
What is Google Trust Services? Google's certificate authority. It issues free 90-day certificates, and it's now the most common issuer on the top 10,000 domains (26.5%), largely because Cloudflare uses it for the sites behind its network.
How do I check when my SSL certificate expires? Click the padlock or site-information icon in your browser and open the certificate, or paste the address into UpWatchr's HTTP Status Checker, which shows the expiry date and the days left.
What happened to eMudhra's certificates? In October 2026 eight of its intermediate certificates turned out to have private keys anyone could work out. Chrome and Firefox blocked them within hours, both dropped the root above them, and eMudhra said it would leave the TLS certificate business. Sites on that root had to get a new certificate from another authority.
Is Let's Encrypt still the biggest certificate authority? Not on the 10,000 most popular domains: Google Trust Services leads there with 26.5% to Let's Encrypt's 21.6%. We didn't measure the rest of the web.
