Agency certificates now expire faster than agency budgets turn over

The week

In April 2025 the CA/Browser Forum, where certificate authorities and browser makers set the rules for publicly trusted TLS certificates, approved ballot SC-081. It cut the maximum lifetime in steps. Certificates issued from March 15, 2026 may last no more than 200 days, down from 398. The cap falls to 100 days on March 15, 2027 and to 47 days on March 15, 2029. The period for reusing domain validation shrinks alongside, to 10 days by 2029. A certificate issued on March 15, 2026 for the full 200 days expires on October 1, 2026. That is also the first day of the federal fiscal year. In the last full week of September, the first wave of full-term certificates under the new cap was coming due. Congress had passed a stopgap funding bill earlier in the month, so no lapse in appropriations loomed this time.

Earlier in this series we looked at certificates from two other angles: the 2021 root expiry that broke legacy clients whose trust stores nobody owned, and the 2026 removal of client authentication from public certificates. This article is about cadence. For most of the past decade, a public certificate lasted about a year. Agencies bought it once a year, renewed it once a year and put it on an annual calendar. Many still do. A 200-day certificate cannot live inside that rhythm, and a 100-day one will need about four renewals a year. The annual model breaks in three places that do not overlap: how certificates are purchased, who does the renewals, and when renewals fall. Fixing one without the others only moves the failure.

Purchasing

Many agencies buy public certificates one at a time. A program office raises a purchase order, a contractor installs the certificate and the order closes. Under a 200-day cap, that cycle runs twice a year for every certificate, and procurement lead times can exceed the margin before expiry. The cycle also ties each renewal to a funding action, which is fragile around the turn of a fiscal year.

The alternative is to buy capacity, not certificates. Most commercial certificate authorities sell multi-year subscriptions under which certificates are reissued as often as needed within the term. Paired with automated issuance through the ACME protocol, an agency can tie issuance to an organizational account instead of individual orders. ACME’s external account binding feature makes that link explicit and auditable. A department-wide agreement, bought through existing government-wide vehicles where possible, turns many small purchases into one managed service. Free certificate authorities remain an option for some public sites. Let’s Encrypt, for instance, has announced that its default lifetime will fall to 45 days by 2028, so the same automation is required either way.

Vendor-hosted services on agency domains need their own terms. Many citizen-facing portals, payment pages and case management systems run on a vendor’s infrastructure under an agency hostname. The contract should say who holds the certificate, that renewal is automated, how much notice the agency gets before expiry, and what service credit applies if a lapse takes the service down. Without that, the agency carries the public failure for a task it does not control. Renewal of the contract itself is the obvious moment to add the clause.

Domain validation needs the same treatment. As reuse periods shrink, someone must prove control of each domain far more often. Delegating a validation record in DNS to the certificate service lets that proof happen automatically, without a ticket to the DNS team each time.

People

An annual task can survive on memory and goodwill. A task that recurs every few months for hundreds of certificates cannot. Each certificate needs a named owner, recorded alongside where it is installed and how it renews. Ownership should sit with a team, so that it survives staff turnover, contractor transitions and reorganizations.

For most agencies the workable model is a small central certificate service with distributed application owners. The central team runs the accounts, the automation, monitoring and the inventory, drawing on certificate transparency logs to find certificates issued for agency domains. Application owners remain responsible for their own endpoints. Automation credentials need protection and separation of duties, because anyone holding them can obtain certificates for agency domains.

Three measures keep the model honest. The share of public certificates renewed automatically shows progress. The count of certificates within 14 days of expiry without a successor shows risk. The count of certificates with no named owner shows governance gaps. All three should reach the CIO monthly, not only when something breaks. State IT agencies can offer the same service to counties and cities that lack the staff to run one.

The calendar

Annual renewals tended to cluster in predictable months and could be scheduled around them. Shorter lifetimes make renewal dates drift. A manual renewal every 200 days will, over a few cycles, land on holidays, the fiscal year-end and any lapse in appropriations. During the 2018 to 2019 shutdown, Netcraft reported that more than 80 certificates used by .gov sites had expired without renewal. Some of those sites were on browsers’ HSTS preload lists, which made them unreachable.

Automation largely removes the calendar problem, provided it keeps running when people are away. Renewal should start well before expiry, typically about two-thirds of the way through a certificate’s life. Certificate authorities that support ACME Renewal Information can also signal when a certificate should be renewed early, for example before a mass revocation. Some systems cannot automate, such as older appliances and some vendor-hosted services. These should be fronted by a load balancer or proxy that can, replaced, or moved to a private certificate authority if only internal users reach them. Agencies should also list certificate renewal among the activities that continue during a lapse in appropriations, and confirm the classification with counsel.

With hindsight

Writing in mid-October 2026, the first full-term 200-day certificates have expired and been replaced. We have found no public reports of a widespread agency outage tied to them, though individual expiries rarely make the news. The schedule has not changed. The 100-day step takes effect on March 15, 2027, and the 47-day step in 2029. Let’s Encrypt began offering 45-day certificates as an option in May 2026 and plans to make shorter lifetimes its default from 2027. Congress has funded the government through December 11, so the next appropriations deadline falls inside the first 100-day cycle. The procurement point has held up. Agencies that bought issuance capacity rather than individual certificates have the most room for the next two steps. Organizations should confirm the schedule with their certificate authorities, since products and profiles vary.