SSL Certificate Validity Is Shrinking to 47 Days: A Practical Guide for Egyptian Website Owners

Short answer: Public SSL/TLS certificates are being capped at shorter lifetimes by the CA/Browser Forum (ballot SC-081v3): 200 days for certificates issued from 15 March 2026 (already in force), 100 days from 15 March 2027 and 47 days from 15 March 2029. Domain-validation reuse shrinks on the same dates, down to just 10 days in 2029. For Egyptian website owners the practical message is simple: renewing by hand once a year is no longer a plan. Inventory every place a certificate lives, switch on automatic renewal (AutoSSL or ACME), monitor the certificate your server actually serves, and keep a fallback ready.

If you still think SSL certificate validity is a year you can renew once and forget, that assumption is already out of date. A certificate is the digital file that proves to a browser that your site owns its domain name and encrypts the connection; when it expires, your customer or patient sees a browser warning before they see your site. What we found in Arabic (October 2026) explains the timeline in general terms. This guide turns it into a plan for small businesses, clinics and shops on shared hosting, VPS and cPanel. We checked the numbers against primary sources on 11 October 2026.

What changed: SSL certificate validity from 398 days to 47 days

The CA/Browser Forum, where browsers and certificate authorities agree the rules for publicly trusted certificates, passed ballot SC-081v3 in April 2025. The Baseline Requirements now set a maximum lifetime and a maximum domain-validation reuse period by the date the certificate is issued:

Two points avoid confusion. These are maximums, and some authorities issue less: DigiCert has capped its public TLS certificates at 199 days since 24 February 2026. And the rule applies by issue date, so a longer certificate issued before 15 March 2026 is not affected.

Domain-validation reuse is how long a certificate authority may rely on an earlier proof that you control a domain. When it falls to 10 days in 2029, most renewals will need fresh proof. If that proof means answering an email or adding a DNS record by hand, you will be doing it every time.

Let's Encrypt's schedule: free certificates get shorter too

Many hosts rely on free Let's Encrypt certificates, and cPanel's documentation says Let's Encrypt is the default provider for its AutoSSL feature. Let's Encrypt published its own schedule on 2 December 2025:

Let's Encrypt says most users with automatic renewal need not change anything, but should check that their automation copes with shorter lifetimes. It warns that a hard-coded 60-day renewal interval will no longer be enough, recommends renewing about two thirds of the way through a certificate's life or using ACME Renewal Information (ARI), and advises against manual renewal.

What breaks first for small Egyptian businesses?

A certificate rarely lives in only one place. Here is where to look; some items are practical inference rather than text in the rules:

• Calendar-based manual renewals: a certificate bought by a former developer or an employee who left, remembered only after it expires. With 100-day and then 47-day cycles, forgetting becomes more likely.
• Certificates installed by hand on cPanel or the mail server: AutoSSL installs domain-validated (DV) certificates for Apache, Dovecot, Exim, Web Disk and the cPanel service. It replaces a manually installed certificate only if the server administrator enables a specific option, and then only when that certificate is invalid or expires within three days. cPanel warns that this option may replace a paid OV or EV certificate with a DV one.
• Load balancers, CDNs and reverse proxies: the new file may reach one server while another keeps the old one. Cloudflare Origin certificates only protect the link between Cloudflare and your server, and Cloudflare says it does not send expiry notifications for them, so track them in your own inventory.
• Payment gateways, API integrations and webhooks: if a partner pins your exact certificate, the connection fails when it changes, and any integration that calls an address with an expired certificate fails too. Ask each provider about its policy before you need the answer.
• Clinic systems: the appointment portal, lab-results page or reception system on its own subdomain, perhaps on a separate server. Make sure each subdomain has a certificate covered by automatic renewal.
• Renewal without a reload: the tool may issue the new file while the service keeps serving the old one, and DigiCert notes that reissuing does not update the certificate on your site automatically.
• Domain validation and DNS: since 15 March 2026 certificate authorities must perform DNSSEC validation for domain-control checks and CAA lookups, and a CAA validation error such as SERVFAIL must not be treated as permission to issue. If your domain is DNSSEC-signed and the chain breaks after a DNS move, issuance may fail. And if a CAA record limits issuance to one authority, make sure it allows the one your tool uses.

A four-step plan: inventory → automate → monitor → fallback

Step 1: Inventory — know every certificate and where it ends

Create a simple shared sheet and record the following for each hostname:

Step 2: Automate — let the tool renew

ACME is the standard protocol that lets a tool on your server request and renew a certificate without a person, after proving control of the domain. How you apply it depends on your setup:

• Shared hosting or cPanel: enable AutoSSL and ask your host to confirm it runs for every subdomain. According to cPanel it runs as part of the nightly system update, and it keeps logs for 30 days, so check them.
• VPS or dedicated server: use an ACME client such as Certbot on a schedule. Certbot's documentation suggests running certbot renew twice a day, and since version 4.0.0 it treats a certificate as due when less than a third of its lifetime remains (it used to be a fixed 30 days). Add a deploy hook that reloads the service after success. Certificates created with the manual plugin do not renew automatically unless you supply an authentication hook script.
• Wildcard certificates: Let's Encrypt issues them only through DNS validation (dns-01), so your DNS panel needs to support automated record changes. Let's Encrypt is also working on DNS-PERSIST-01, which keeps the validation record fixed, and expected it in 2026. Check whether your client supports it.

Step 3: Monitor — watch what the server serves, not what was issued

A successful renewal in the tool's log does not prove visitors see the new certificate. Monitor the public endpoint itself, with an alert early enough for a human to act. Let's Encrypt ended its expiry emails on 4 June 2025 and points to independent monitoring services, including Red Sift Certificates Lite, listed as free for up to 250 certificates, without endorsing any of them.

Step 4: Fallback — what if renewal fails?

Write a half-page emergency note: who has access to the hosting panel and the DNS panel, how to issue a certificate manually as a stop-gap, and who calls the hosting provider. Test renewal in advance with certbot renew --dry-run. Add any paid OV or EV certificate to the inventory too, since it is subject to the same validity limits.

How to check your certificate's expiry date in a minute

In the browser: click the padlock or site-information icon next to the address bar, open the connection or certificate details and read the expiry date (Not After). The exact wording varies by browser.

From the command line (OpenSSL is available on Linux, macOS and with Git on Windows), replace example.com with your domain:

• echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates — shows the subject, the issuer, and the start and end dates.
• echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 1209600 — tells you whether the certificate will expire within 14 days (1209600 seconds) and returns a non-zero exit code if it will, which suits automated monitoring.
• For a mail server, use the same command with the service port, such as 993, or the -starttls smtp option with port 587. Mail and booking portals can present a different certificate from your main site, so test each one.

Why buying a multi-year certificate does not solve it

There is a real difference between the term you pay for and the validity the browser accepts. According to DigiCert's documentation, its multi-year plans let you pay one price for up to three years of coverage, but each certificate issued under a plan is capped at 199 days. You reissue it at no extra cost each time it expires, may need to revalidate your domain and organisation, and the new certificate is not installed on your server automatically. A longer purchase changes how you pay, not how often you install. The fix is automation.

Where to start this week

Start with the inventory and the real expiry dates, then move what you can to automatic renewal. If your site, mail or system runs on Smart One Group hosting, the hosting page lists free SSL that renews automatically among its plan features. If you want your certificates reviewed and renewals automated with a team following up, see our support retainers or talk to us and we will look at your setup with you. And remember that domain renewal and DNS settings are part of the same chain.

Frequently asked questions

Are all SSL certificates now 200 days?

No. 200 days is the maximum for public certificates issued from 15 March 2026, not a fixed lifetime, and an authority may issue less. A longer certificate issued before that date stays valid to its end, because the rule applies by issue date.

Does the rule cover free Let's Encrypt certificates?

Yes. Let's Encrypt says the change is required by the Forum's Baseline Requirements and that all publicly trusted authorities will make similar changes, following the schedule above.

Is cPanel hosting enough?

AutoSSL usually lightens the load, but do not assume. Check that it runs for every subdomain, read its logs, and remember that it installs DV certificates only and replaces a manually installed one only under specific conditions.

Should I buy a three-year certificate to be safe?

No. The certificate stays capped at its maximum lifetime, and you will reissue and install it several times during the term. Invest in automated renewal and monitoring instead.

What if my DNS panel has no API?

For ordinary names you can use HTTP validation on port 80, which needs no DNS changes. A Let's Encrypt wildcard certificate requires DNS validation, so consider moving DNS hosting to a provider that supports automation, after checking the effect on your records.

Do Cloudflare Origin certificates matter?

Yes, add them to your inventory. They only encrypt the link between Cloudflare and your server, and Cloudflare says it does not currently send expiry notifications for them, so record their dates and monitor them yourself.

Sources: CA/Browser Forum Baseline Requirements (version 2.3.1), Let's Encrypt's 45-day announcement, cPanel's AutoSSL documentation and DigiCert's multi-year plan documentation. Dates may be revised by the bodies involved.