Handle TLS certificate renewal by automating it with the ACME protocol, keeping an inventory of every certificate and alerting long before expiry. Lifetimes are getting shorter, so renewal that depends on a person remembering will eventually miss one, and an expired certificate takes a service offline.
Why is renewal getting more frequent?
Public certificate authorities follow the CA/Browser Forum Baseline Requirements, the technical rules for publicly trusted certificates, and those rules are shortening how long a certificate may last. Let's Encrypt's announcement of its own plans shows the direction. Today its certificates last 90 days. It says its opt in tlsserver profile moves to 45 day certificates on 13 May 2026, its default classic profile moves to 64 days on 10 February 2027, and the classic profile moves to 45 days on 16 February 2028. It also says the shorter schedule is being made because the Baseline Requirements mandate it, and that other publicly trusted authorities will make similar changes. It also shortens how long a past domain validation can be reused, down to 7 hours by 2028.
Check the current Baseline Requirements and your own authority's notices for the schedule that applies to you, because dates may change.
What is ACME?
RFC 8555 defines the Automatic Certificate Management Environment, a protocol that lets a certificate authority and an applicant automate domain verification and certificate issuance. A client creates an account, requests a certificate for one or more identifiers, proves control of them through challenges, submits a certificate signing request and downloads the result. It also handles revocation, and the client can contact the authority periodically to fetch renewed certificates so the server stays current without manual steps.
Two challenge types are well known: http-01, where the server validates control by an HTTP request, and dns-01, where it validates by a DNS query. The http-01 type is simple for public web servers. The dns-01 type works for internal names and wildcard needs but requires the client to be able to change DNS records.
Where do renewals fail?
Forgotten certificates. An old device, a legacy load balancer or a test site that nobody listed.
Manual steps. A person must upload a file or click through a console.
Validation breakage. A firewall rule blocks the validation request, or a DNS credential expired.
Renewed but not deployed. The new certificate is issued, but the service never reloads it.
Other certificate types. Internal certificates, client certificates and certificates in embedded devices often fall outside the automation.
Constructed example: the Friday expiry
A payments API sits behind a load balancer whose certificate was uploaded by hand two years ago. The person who did it has left, and the reminder email goes to their old address. On a Friday morning the certificate expires, clients refuse to connect and revenue stops. The fix takes forty minutes, mostly spent finding who has access. After the incident the team moves the endpoint to an ACME client, adds the certificate to an inventory with an owner, and sets an alert at 21 days before expiry.
The incident is invented, but outages of this kind are a familiar story.
How should you monitor?
Alert on days to expiry for every certificate you know about, from the outside as well as from your inventory, because an external check proves the live endpoint serves the new certificate. Alert at several thresholds, and send them to a team mailbox or channel, not a person. Also alert on failed renewal attempts, since a failure at day 30 is fixable and a failure at day 1 is not.
Code and infrastructure repositories sometimes hold private keys. Safeguard's secrets scanning can flag keys committed to a repository, which is one reason to keep private keys out of source control entirely.
How to check or apply this
- List every public and internal certificate, its owner, expiry date and where it is installed.
- Move web endpoints to an ACME client with automatic renewal and reload.
- Test the renewal path in a staging environment, including the reload.
- Check that firewall and DNS rules permit domain validation.
- Alert at 30, 14 and 7 days, and on any failed renewal.
- Run an external expiry check against live endpoints.
- Keep private keys out of source control and rotate them with renewals where your policy requires.
Quick check
What is the simplest way to avoid expired certificates?
Automate renewal with an ACME client, then monitor expiry from the outside so you notice if automation fails.
Do shorter lifetimes make us less secure?
No. Shorter lifetimes limit how long a stolen key or outdated validation stays useful, but they require automation to avoid outages.
Sources
- RFC 8555, Automatic Certificate Management Environment (ACME)
- Let's Encrypt, Decreasing Certificate Lifetimes to 45 Days
Last reviewed: 18 October 2026.
