What is a TLS certificate lifetime?

TLS certificate lifetime is the period from the day the certificate that provides a site’s HTTPS connection is issued to the day its validity ends.

This certificate is not the same thing as the ISO or product certificates on your certificate page. A quality certificate shows that an organization was audited; a TLS certificate lets the browser verify that it is connecting to your site encrypted and at the right address. Because the names are similar, they get confused; both have a lifetime, but under different rules.

The maximum lifetime is set by the CA/Browser Forum, the joint body of certificate authorities and browser makers. A ballot adopted by the forum on April 11, 2025, shortens the lifetime step by step: since March 15, 2026, at most 200 days; the next steps of the schedule make certificates even shorter-lived.

Does a valid TLS certificate show that a site is secure?

Only that the connection is secure. A valid certificate encrypts the traffic between the browser and the server and verifies that the right address was reached; it does not show that the site’s software is up to date or that the company is trustworthy. The addresses the certificate covers also matter: if the certificate does not cover the address with or without www, the browser shows a name mismatch warning. Whether the site’s software is up to date is a separate matter, covered in the cost of an outdated website guide.

What changes for the site owner as lifetimes shorten?

Renewal becomes more frequent. A certificate renewed by hand once a year now has to be renewed at least twice a year; as the schedule moves on, manual renewal becomes unsustainable. For an expired certificate, the browser shows a warning before opening the page, and most visitors turn back there. That is why the real question is not the certificate’s lifetime but whether renewal is automatic.

From the browser’s point of view, there is no difference between a paid and a free certificate: if both are valid, the address bar looks the same. The difference is in the renewal arrangement: a certificate suited to automatic renewal needs less manual work as lifetimes shorten.

• You can see your certificate’s expiry date from the padlock icon in the browser’s address bar.
• Ask your hosting company whether renewal is automatic.
• If it is not automatic, put the expiry date in the calendar and renew before it.
• If the certificate covers several addresses (with and without www), check that they are all in the list.

All the steps of the schedule, the other causes of the “Not secure” warning and what to do are in the if your site says “Not secure” guide.

For a site that shows your certificates as a record buyers can verify, B2B website builds and measures the certificate page, the product scope and the path to a quote together.