The 200-Day Cliff: How Ready Are the Web's Top Sites for Shorter SSL Certificates?
We scanned the HTTPS certificates of the top 10,000 websites (Tranco list N26XW) on 17–18 October 2026. Of the 8,213 sites that served a certificate, 17.0% still use one issued under the old rules, valid for longer than the new 200-day limit, and every one of them has to renew under the new rules within about six months.
Key findings
- 1,396 sites (17.0%) still run on pre-limit certificates. All of them were issued before 15 March 2026, so they expire by spring 2027 at the latest, right around the move to 100-day certificates.
- The biggest sites use the longest certificates. In the top 1,000, 18.9% are on pre-limit certificates and only 38.8% use certificates of 90 days or less. In the 5,000–10,000 band, those figures are 16.0% and 54.2%.
- 44 sites served an expired certificate when we checked, 5 of them in the top 1,000.
- 390 sites (4.7%) had less than 30 days left, and 30 had less than a week.
- Two free, automated issuers dominate. Google Trust Services issues 26.5% of certificates and Let's Encrypt 21.1%, followed by DigiCert (14.6%) and Amazon (13.8%).
Why this matters now
Public TLS certificates are getting shorter on a fixed schedule, and the next cut is five months away. Under CA/Browser Forum ballot SC-081v3, the maximum lifetime drops in three steps:
| From | Maximum certificate lifetime |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
At 47 days, a site renews roughly eight times a year. Every manual step in that process becomes a recurring chance to miss a deadline.
The safety net is also thinner. Let's Encrypt stopped sending certificate expiry reminder emails on 4 June 2025, so many site owners no longer get any warning before a certificate lapses.
How we measured it
We connected to each of the top 10,000 domains in the Tranco list N26XW (covering 15 September to 14 October 2026) over HTTPS on port 443 between 17 and 18 October 2026. For each domain we tried the apex first, then www, and recorded the certificate the server actually presented.
For every certificate we stored the issuer, the validity start and end dates, the resulting lifetime in days, and the days remaining on the scan date. A certificate counts as pre-limit when its lifetime exceeds 200 days.
A short lifetime is a strong sign of automated renewal, because nobody renews 90-day certificates by hand for long. A long lifetime is not proof of manual renewal: Amazon's managed certificates, for example, are long-lived and renewed automatically. We therefore report lifetimes, not guesses about how each site renews.
Limitations: 1,786 domains (17.9%) did not return a certificate and are excluded. Most of them (1,340) did not resolve on either the apex or www, which is typical for the API, CDN and tracking domains that appear in popularity rankings. We excluded 16 certificates longer than 398 days, which come from self-signed or private certificate authorities. We also excluded 14 certificates of around 365 days that were issued after 15 March 2026: 12 come from Russia's national certificate authority, which is outside the browser root programs and not bound by CA/Browser Forum rules, and 2 are private or test certificates. We saw only the certificate served to our scanner, not certificates on other hostnames, CDN edges or internal services.
The full dataset is available as CSV.
Findings
1. One in six top sites still uses a pre-limit certificate
Of the 8,213 sites that served a certificate, 1,396 presented a publicly trusted certificate with a lifetime between 201 and 398 days. Certificates that long can no longer be issued, so each of these sites will meet the new rules at its next renewal, by spring 2027 at the latest.
| Rank band | Sites with a certificate | Pre-limit (over 200 days) | 90 days or less |
|---|---|---|---|
| Top 1,000 | 773 | 18.9% | 38.8% |
| 1,001–5,000 | 3,195 | 17.9% | 45.0% |
| 5,001–10,000 | 4,245 | 16.0% | 54.2% |
| All | 8,213 | 17.0% | 49.1% |
2. The biggest sites use the longest certificates
You might expect the most visited sites to be furthest along. The opposite is true: only 38.8% of the top 1,000 use certificates of 90 days or less, compared with 54.2% of sites ranked 5,001–10,000.
The largest sites lean on commercial certificate authorities and managed cloud certificates, which have historically been issued for a year at a time. Many of them do renew automatically, but they have not yet had to prove that their renewal pipeline works at 100-day, let alone 47-day, intervals.
3. Expired certificates come mostly from long-lived issuers
44 sites (0.5%) served an expired certificate when we checked, 5 of them in the top 1,000. Another 390 (4.7%) had less than 30 days left, and 30 had less than a week.
Who issued the expired certificates is telling. Let's Encrypt issues 21.1% of all certificates in our sample but accounted for just 2 of the 44 expired ones. DigiCert, GlobalSign and Sectigo together issue 28.3% of certificates and accounted for 21 of them.
4. Who issues the web's certificates
Two free, ACME-based issuers now account for almost half of the top 10,000. The four commercial and cloud issuers below them still issue certificates averaging around 250–275 days, the gap that the new rules will close.
What site owners should do before March 2027
The fix is the same for every site: make renewal automatic, then make sure someone hears about it when automation fails.
- List every hostname that serves a certificate, including
www, API, mail, status and staging subdomains. Forgotten hostnames cause most surprise expiries. - Move to ACME-based automated renewal wherever your host or CDN supports it.
- Renew at two-thirds of the lifetime, not in the final week. With 100-day certificates that means around day 66.
- Monitor from outside. Automation fails silently: a changed DNS record, a full disk or an expired API token stops renewals without any error you will see.
- Send alerts to a shared inbox or channel, not to one person who may be on holiday.