Expiry is a security feature
A certificate is a time-bound claim that a key belongs to a domain. An expiry date ensures the claim does not hold forever — because domain ownership changes, and keys can be compromised.
Why short lifetimes are better
- Limits damage from a key leak — a leaked key is only usable until the certificate expires.
- Reduces reliance on revocation — revocation is unreliable; short lifetimes are a more robust safeguard.
- Forces automation — which makes the whole system more resilient.
Lifetimes are getting shorter
The industry has gone from multi-year certificates to 90 days — and is heading toward shorter still. We cover the transition in 47-day certificate lifetimes. The implication is clear: manual renewal no longer scales.
How to avoid expiry downtime
Automate renewal via ACME, and monitor all certificates — including those ACME does not manage (on load balancers, CDNs, at suppliers). More concretely in avoid expired certificates.
How CertControl helps
CertControl discovers all your certificates and warns you well before they expire — and can renew automatically via ACME. No spreadsheets, no surprises, no expiry downtime.
Frequently asked questions
Why do SSL certificates expire at all?
To limit risk: an expiry date ensures a key is not valid forever, which reduces the damage if the key leaks and keeps domain ownership current.
How long is a certificate valid?
Public TLS certificates today are typically valid for up to 90 days, and lifetimes are heading toward shorter still.
How do I stop a certificate from expiring?
Automate renewal via ACME and monitor all certificates — including those on load balancers, CDNs and at suppliers.