On this page
The longest a public TLS certificate may last fell from 398 days to 200 on March 15, 2026, and falls to 100 days on March 15, 2027, under the CA/Browser Forum's Ballot SC-081. Let's Encrypt moves its default from 90 days to 64 on February 10, 2027 (its announcement). We looked at what IPv4 serves on port 443. On October 22, Web IP held 25,481,947 hosts presenting a browser-trusted certificate: 35.5% on one of 100 days or less, 43.6% on 101 to 200 days, and 20.9% still on one over 200 days. 3,111,164 of those on 101 to 200 days were past their certificate's 100th day.
The schedule
| From | Longest public TLS certificate | Let's Encrypt's default |
|---|---|---|
| Before March 15, 2026 | 398 days | 90 days |
| March 15, 2026 | 200 days | 90 days |
| February 10, 2027 | 200 days | 64 days |
| March 15, 2027 | 100 days | 64 days |
| 2028 | 100 days | 45 days |
| March 15, 2029 | 47 days | 45 days |
What IPv4 serves on port 443
37,331,200 IPv4 hosts completed a TLS handshake on port 443. 25,481,947 of them (68.3%) presented a certificate whose chain validates to a browser-trusted root, 9,410,884 distinct certificates between them. By the certificate's lifetime:
| Certificate lifetime | Hosts | Share |
|---|---|---|
| 100 days or less | 9,051,256 | 35.5% |
| 101 to 200 days | 11,101,236 | 43.6% |
| Over 200 days | 5,329,455 | 20.9% |
None of the 20,152,492 hosts presenting a certificate issued since March 15 has one longer than 200 days. Every certificate over 200 days was issued before the cap, the longest at 397 days, and 346,620 hosts present one that's still valid on March 15, 2027.
By certificate authority
The CA is the organization that issued the certificate. The last column is the share of a CA's hosts on 101-to-200-day certificates that were past day 100.
| CA | Trusted hosts | 100 days or less | 101 to 200 days | Over 200 days | Past day 100 |
|---|---|---|---|---|---|
| Let's Encrypt | 7,579,074 | 100% | 0% | 0% | - |
| Amazon | 6,954,606 | <0.1% | 73.7% | 26.3% | 23.0% |
| DigiCert | 4,313,639 | 4.7% | 56.7% | 38.6% | 30.5% |
| Sectigo | 1,487,016 | 2.0% | 54.5% | 43.6% | 41.3% |
| GlobalSign | 1,155,893 | 7.3% | 56.0% | 36.7% | 28.0% |
| Microsoft | 961,548 | 39.0% | 56.7% | 4.4% | 2.7% |
| GoDaddy | 454,749 | 2.1% | 56.0% | 41.9% | 38.0% |
| Google Trust Services | 331,619 | 100% | 0% | 0% | - |
| Every other CA | 2,243,803 | 19.5% | 56.7% | 23.8% | 44.2% |
No host presents a Let's Encrypt or Google Trust Services certificate longer than 90 days, so all of theirs are already under next March's cap. For every other CA, the longest certificate it may issue halves again on March 15, 2027.
Past day 100
Of the 11,101,236 hosts on a 101-to-200-day certificate, 3,111,164 (28.0%) were more than 100 days into it when we saw them, on 597,596 distinct certificates. A 100-day certificate issued the same day would already have expired on every one of them. From March 15, 2027 every new certificate is at most 100 days long, so a renewal that now comes after day 100 has to come sooner.
Let's Encrypt's 64-day switch
7,474,376 hosts present a 90-day Let's Encrypt certificate. Up to day 59, each day of age holds about 117,000 of them. Day 60 holds 50,329, and each day after it about 14,000, so most renew by day 60.
303,967 hosts (4.1%) hold one more than 64 days old, which is a renewal too late for a 64-day certificate, and 401,837 (5.4%) are past day 60. Let's Encrypt's advice is to renew at about two-thirds of the lifetime, or let the CA say when through ACME Renewal Information (RFC 9773), and to grep cron jobs, scripts and runbooks for hard-coded 83, 80 or 60.
Some hosts have already moved: 100,953 present Let's Encrypt's six-day certificate and 3,745 its 45-day one.
Expired certificates
3,791,763 of the 37.3 million hosts on port 443 (10.2%) present an expired certificate, self-signed ones included. Of the 8,627,112 hosts presenting a Let's Encrypt certificate, 980,764 (11.4%) present an expired one: 410,582 expired more than a year before we saw them, 450,477 between 31 and 365 days before, and 119,705 (1.4% of Let's Encrypt's hosts) within the last 30 days.
Checking your own ranges
Web IP has every host on port 443 with its certificate's cert_not_before, cert_not_after, cert_issuer_dn and cert_browser_trusted, and the day it was last seen in last_seen (schema). Filtered to the ranges you own or protect, a certificate of 101 to 200 days that's more than 100 days old (last_seen minus cert_not_before) is a renewal to bring forward before March 15. A Let's Encrypt certificate past day 64 is one to bring forward before February 10. A cert_not_after before last_seen is a server presenting an expired certificate now. Joined to IP ASN by address, the same filters count them by network, for a customer's or a vendor's space as well as your own.
How we counted
Every figure is from Web IP's October 22 build, the IPv4 hosts on port 443, each as we last saw it. A host is an address, not a website. It presents the certificate it serves by default, and one certificate can sit on many addresses, as the distinct counts above show. A certificate's lifetime runs from cert_not_before to cert_not_after, and its age from cert_not_before to the day we saw the host. A trusted host is one whose cert_browser_trusted is set. The CA is the organization in cert_issuer_dn, with DigiCert's two spellings merged and GoDaddy's two. The launch post shows what else a row holds.
Getting access
Web IP is a gzipped CSV download, and its docs list the columns. To license it, see pricing or talk to us.
