Shorter SSL Certificates: Automate Renewals with AI

If your website's padlock has ever turned into a scary browser warning, you know how fast an expired SSL certificate kills trust. Customers see "Your connection is not private" and they leave. Until recently, most small businesses could get away with renewing once a year and setting a calendar reminder. That window is closing, fast.

Here's what changed, what it means for a typical Burnaby or Vancouver business website, and where AI actually helps (and where it doesn't).

The rules got stricter in March 2026

The CA/Browser Forum is the group of certificate authorities and browser makers that sets the rules for publicly trusted website certificates. In April 2025 it adopted Ballot SC081v3, proposed by Apple and endorsed by Sectigo, Google Chrome and Mozilla. The vote wasn't close: 25 certificate issuers voted yes with 5 abstaining and none against, and all 4 voting browser makers said yes.

The schedule now sits in the official Baseline Requirements (version 2.3.1, dated 4 October 2026). As of October 2026, the maximum lifetime of a public TLS certificate is:

• 200 days for certificates issued on or after 15 March 2026 (this is already in force)
• 100 days from 15 March 2027
• 47 days from 15 March 2029
• Domain validation data can be reused for 200 days now, dropping to 100 days in 2027 and just 10 days in 2029

That last point matters more than people expect. Today, your certificate provider can often lean on an earlier proof that you control your domain. By 2029, that proof goes stale after ten days, so the provider has to check again almost every time it issues.

The Forum's reasoning, in the ballot's own words, is that shorter lifetimes and reuse periods increase "the average net reliability of certificates" because the information inside a certificate drifts away from reality over time.

Let's Encrypt is moving even faster

If your site uses a free Let's Encrypt certificate (very common on WordPress hosts and small business stacks), the timeline is a little different. In its December 2025 post, Decreasing Certificate Lifetimes to 45 Days, Let's Encrypt laid out this plan:

1. 13 May 2026: its opt in "tlsserver" profile switches to 45 day certificates.
2. 10 February 2027: the default "classic" profile drops to 64 day certificates, with a 10 day authorization reuse period.
3. 16 February 2028: the classic profile goes to 45 day certificates, with authorization reuse cut to 7 hours.

Their advice is blunt: "Manually renewing certificates is not recommended, as it will need to be done more frequently with shorter certificate lifetimes." They also tell subscribers to have monitoring that alerts them if a certificate isn't renewed when expected.

And here's a detail a lot of business owners missed. Let's Encrypt stopped sending expiration reminder emails on 4 June 2025. Their reasons included cost ("tens of thousands of dollars per year"), privacy, and the fact that most subscribers had already automated renewals. So if you were relying on that email to remind you, it's gone.

What "automate it" really means

Good news first: the core renewal job is a solved problem, and it isn't AI. It's a standard protocol called ACME, published by the IETF as RFC 8555 in 2019. An ACME client on your server or hosting platform proves domain control, fetches a new certificate and installs it, without a human.

A newer standard, RFC 9773, ACME Renewal Information (ARI), published in June 2025, lets the certificate authority tell your client when to renew. That helps if a certificate has to be replaced early, for example after a mass revocation. Let's Encrypt recommends ARI, and for clients that don't support it, suggests renewing about two thirds of the way through a certificate's life rather than on a fixed date.

For many small sites, automation is already switched on by the host. Most hosted website builders and many managed WordPress plans issue and renew certificates for you, so check your host's settings before you change anything. The risk lives in the edges:

• A custom domain on a booking tool or landing page builder that someone set up years ago
• An office router, NAS, phone system or camera recorder with its own web login
• A certificate bought from a reseller and pasted into cPanel by hand
• A DNS change (new email provider, new site builder) that silently breaks the validation step

When certificates last a year, a broken renewal gives you months of slack. At 47 days, with Let's Encrypt suggesting renewal around the two thirds mark, you'd have roughly two weeks between a failed renewal and an outage. Miss one alert and you're down.

Where AI fits in

This is where we're careful, because AI is not what renews your certificate. ACME does that, deterministically, and you shouldn't swap a reliable protocol for a language model.

What an AI assistant is good at is the messy work around it:

Finding everything. Most businesses don't have a list of every domain and subdomain they own. An AI agent can work through your DNS records, invoices, hosting accounts and public certificate transparency logs, then build an inventory a person can check.

Watching and triaging. A monitoring script can check expiry dates daily. An AI layer can read the failure, spot that it's a DNS validation error after last week's email migration, and send your office manager a plain English message instead of a cryptic log line.

Writing the runbook. When a device can't run ACME, the AI can draft step by step renewal instructions for that specific box, and remind the right person on the right day.

That's the honest pitch: deterministic tools do the renewal, AI handles the inventory, the reading and the human follow up.

Where this doesn't apply

Not every business needs a project here. A few honest limits:

• Fully hosted sites are probably fine. If your only web presence is on a platform that manages certificates for you, there may be nothing to automate. Check once, then move on.
• Internal certificates are a different case. The Baseline Requirements cover publicly trusted TLS certificates. Certificates issued by your own private certificate authority for internal systems aren't bound by this schedule, though many of the same habits help.
• Old hardware may not cooperate. Some legacy devices can't run an ACME client at all. Sometimes the right answer is putting them behind a proxy that can, or replacing them, not layering AI on top.
• AI can be wrong. A model that misreads an error or invents a fix is worse than a plain alert. Any AI step should suggest, not silently change production DNS or server configs.
• The rules can still move. The dates above come from the October 2026 Baseline Requirements and Let's Encrypt's December 2025 plan. Later ballots or policy updates could change them, so recheck the current documents before you plan around a specific date.

A simple checklist for this quarter

Start with a list of every domain and subdomain you serve over HTTPS. For each one, write down who issues the certificate, how it renews, and who gets told when renewal fails. If any answer is "a person remembers," that's your first fix. You've got until 15 March 2027 before 100 day certificates arrive, which is plenty of time if you start now and very little if you wait.

Sources

• CA/Browser Forum, "Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods," 2025. cabforum.org
• CA/Browser Forum, "Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates," Version 2.3.1, 2026. github.com/cabforum/servercert
• Let's Encrypt, "Decreasing Certificate Lifetimes to 45 Days," 2025. letsencrypt.org
• Let's Encrypt, "Ending Support for Expiration Notification Emails," 2025. letsencrypt.org
• IETF, RFC 8555, "Automatic Certificate Management Environment (ACME)," 2019. rfc-editor.org
• IETF, RFC 9773, "ACME Renewal Information (ARI) Extension," 2025. rfc-editor.org

Not sure which of your certificates would fail first? Autana Solutions is based in Burnaby and works with businesses across Metro Vancouver. Book a free call and we'll help you map your domains, spot the manual renewals, and decide whether automation, AI monitoring, or nothing at all is the right move.