47-day SSL certificates are coming, and if that phrase means nothing to you yet, it will very soon. Starting March 2029, every public website’s SSL certificate — the thing that makes your site show a padlock instead of a scary “Not Secure” warning — will need to be renewed every 47 days. That’s down from the year-long certificates most of us are used to. For a self-hosted government site running many domains and subdomains, that’s not a minor inconvenience — it’s a scheduling nightmare waiting to happen if we don’t plan ahead. The good news: this isn’t happening overnight, and there’s a clear path to get ready without losing sleep. This post breaks down what’s changing, why it matters, and exactly what our plan should look like — no jargon, no panic, just a straight answer to one question: are we prepared?
Table of Contents
- What Is This 47-Day Renewal Cycle, Anyway?
- Wait, What’s an SSL Certificate? (Quick Refresher)
- Why Is This Even Happening?
- Our Plan of Action: What We Need to Do, and By When
- The Workaround vs. The Real Fix: Manual Renewal vs. ACME Automation
- How Do We Actually Automate This? (Brief ACME Implementation Overview)
- What Will This Cost Us? (Wildcard Certificates)
- Cost at Scale: What About Up to 2,000 Websites?
- Conclusion + Downloadable Checklist (PDF)
- FAQs
What Is This 47-Day Renewal Cycle, Anyway?
The 47-day SSL certificates rule comes from the CA/Browser Forum — the industry group of browser makers (Apple, Google, Microsoft, Mozilla) and certificate authorities that decides how long a certificate is allowed to live before it expires. They voted, almost unanimously, to shrink certificate lifespans in stages:
- By Feb 2026: up to 398 days
- March 2026: dropped to 200 days
- March 2027: drops to 100 days
- March 2029: drops to 47 days
We’re currently in the 200-day window. The 47-day cliff is still a few years out — but “a few years” disappears fast when you’re managing certificates across many self-hosted servers.
Wait, What’s an SSL Certificate? (Quick Refresher)
Think of an SSL certificate as your website’s ID card. It proves to visitors’ browsers that your site is really yours, and it encrypts the data flowing between the browser and your server — form submissions, login credentials, sensitive citizen data, all of it. No valid certificate, no padlock, no trust. Browsers will actively warn people away from the site, which is bad for the public we serve and worse for confidence in a government platform.
Why Is This Even Happening?
Shorter lifespans mean less time for a stolen or misconfigured certificate to do damage. If a private key leaks, a certificate that expires in 47 days limits the blast radius far better than one that’s valid for over a year. It also forces everyone off manual, error-prone renewal habits and onto automation — which, frankly, we should be using already.
Our Plan of Action: What We Need to Do, and By When
- Inventory everything now. Every domain, subdomain, and certificate across our self-hosted infrastructure needs to be listed — government sites often have more subdomains than people realize.
- Flag manual renewals. Any server still relying on someone manually requesting and installing a Sectigo certificate is a liability under a 100-or-47-day clock.
- Confirm Sectigo’s ACME support. Since we already procure through Sectigo, check their ACME endpoint and integration options before evaluating anything else.
- Pilot automation on one server before rolling out across the full self-hosted environment.
- Set internal deadlines ahead of each CA/Browser Forum milestone (2027, 2029) — not on the deadline itself. For a government site, build in extra buffer for change-control and approval processes.
The Workaround vs. The Real Fix: Manual Renewal vs. ACME Automation
The “workaround” is what we do today — someone manually requests a certificate through Sectigo, downloads it, and installs it on our servers. At 100 or 47 days, that’s not sustainable; on a self-hosted government site, a missed renewal means a public-facing outage with no CDN or managed host to fall back on.
The real fix is ACME automation. ACME (Automated Certificate Management Environment) is a protocol that requests, validates, installs, and renews certificates automatically, without a human in the loop. Sectigo supports ACME issuance, so we don’t need to switch certificate authorities — we need to connect our existing Sectigo account to an ACME client on our servers.
How Do We Actually Automate This? (Brief ACME Implementation Overview)
Here’s roughly how ACME automation works in practice, in plain terms:
- Install an ACME client on each server — common options are Certbot, acme.sh, or win-acme (for Windows/IIS environments). This is the software that talks to Sectigo on our behalf.
- Connect the client to Sectigo’s ACME endpoint using our account credentials, so requests are issued under our existing Sectigo agreement rather than a free public CA.
- Choose a validation method — DNS-01 (proves domain ownership via a DNS record) or HTTP-01 (proves it via a file on the web server). DNS-01 is generally better for wildcard certificates and for servers behind firewalls, which is common on government infrastructure.
- Automate the renewal job. The ACME client runs on a schedule (e.g., a nightly cron job or scheduled task) that checks certificate expiry and renews automatically well before the deadline — no manual download-and-install step.
- Auto-reload the web server after renewal so the new certificate takes effect without downtime.
- Keep monitoring/alerts as a backup, even with automation running, in case a renewal silently fails.
This keeps us on Sectigo as our trusted CA while removing the manual bottleneck entirely.
What Will This Cost Us? (Wildcard Certificates)
A wildcard SSL certificate through Sectigo typically runs $100–$300+ per year, depending on validation level (DV, OV, or EV) — government sites often require OV or EV for the added identity assurance. Under the new renewal cycle, the certificate cost itself likely won’t change much even with more frequent issuance; the real cost shifts toward implementing and maintaining the ACME automation layer.
Cost at Scale: What About Up to 2,000 Websites?
For a self-hosted environment at this scale, budget for:
- ACME client deployment and integration: internal engineering/IT time to install and configure clients across servers — the largest cost driver for a self-hosted setup
- Sectigo certificate costs: existing procurement relationship continues; volume/enterprise pricing may apply
- Monitoring and alerting tooling: roughly $2,000–$10,000+ per year, depending on the platform
- Change-control and testing overhead: government environments typically require formal testing/approval cycles, which should be factored into rollout timelines
These are ballpark estimates — actual figures depend on server count, team capacity, and existing IT tooling.
Conclusion + Downloadable Checklist (PDF)
The 47-day certificate cycle isn’t arriving tomorrow, but it is arriving — and manual renewal simply won’t survive it. The teams that move to ACME automation early, on our existing Sectigo relationship, will barely notice the transition; the ones that wait will be scrambling in 2027 and firefighting in 2029. We have time. Let’s use it.
A downloadable PDF checklist summarizing every action item above can be downloaded here for internal distribution and it will be updated on regular basis.
FAQs
What happens if we miss a certificate renewal?
The site will show browser security warnings or become inaccessible until a new certificate is installed, which can disrupt public access and internal tools alike.
Do internal or private sites need to follow this timeline?
No — the CA/Browser Forum rules apply only to publicly trusted SSL/TLS certificates, not internal or private PKI systems.
Can we avoid the 47-day cycle by switching certificate authorities?
No. The rule applies to all publicly trusted certificate authorities, including Sectigo, so switching CAs won’t help — automation is the only sustainable path.
Does moving to ACME automation mean we lose our Sectigo relationship?
No. Sectigo supports ACME issuance, so automation connects to our existing account and procurement agreement rather than replacing it.
Ashutosh Bishnoi writes on digital trust, PKI, and cybersecurity, drawing on years of hands-on experience in the digital signature and certificate authority industry. He covers both enterprise-grade infrastructure topics and plain-English guidance for teams navigating certificate management, electronic signatures, and evolving security standards.