# TLS certificate lifetimes: 3.1M servers already past day 100

On October 22, 35.5% of IPv4 hosts with a trusted certificate were on one of 100 days or less, 20.9% over 200, and 3.1M past day 100 of a 200-day one.

The longest a public TLS certificate may last fell from 398 days to 200 on March 15, 2026, and falls to 100 days on March 15, 2027, under the CA/Browser Forum's [Ballot SC-081](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/). Let's Encrypt moves its default from 90 days to 64 on February 10, 2027 ([its announcement](https://letsencrypt.org/2026/10/07/64-day-certs)). We looked at what IPv4 serves on port 443. On October 22, [Web IP](https://internetdata.io/databases/web-ip) held 25,481,947 hosts presenting a browser-trusted certificate: 35.5% on one of 100 days or less, 43.6% on 101 to 200 days, and 20.9% still on one over 200 days. 3,111,164 of those on 101 to 200 days were past their certificate's 100th day.

## The schedule

| From | Longest public TLS certificate | Let's Encrypt's default |
|---|---|---|
| Before March 15, 2026 | 398 days | 90 days |
| March 15, 2026 | 200 days | 90 days |
| February 10, 2027 | 200 days | 64 days |
| March 15, 2027 | 100 days | 64 days |
| 2028 | 100 days | 45 days |
| March 15, 2029 | 47 days | 45 days |

## What IPv4 serves on port 443

37,331,200 IPv4 hosts completed a TLS handshake on port 443. 25,481,947 of them (68.3%) presented a certificate whose chain validates to a browser-trusted root, 9,410,884 distinct certificates between them. By the certificate's lifetime:

| Certificate lifetime | Hosts | Share |
|---|---|---|
| 100 days or less | 9,051,256 | 35.5% |
| 101 to 200 days | 11,101,236 | 43.6% |
| Over 200 days | 5,329,455 | 20.9% |

None of the 20,152,492 hosts presenting a certificate issued since March 15 has one longer than 200 days. Every certificate over 200 days was issued before the cap, the longest at 397 days, and 346,620 hosts present one that's still valid on March 15, 2027.

## By certificate authority

The CA is the organization that issued the certificate. The last column is the share of a CA's hosts on 101-to-200-day certificates that were past day 100.

| CA | Trusted hosts | 100 days or less | 101 to 200 days | Over 200 days | Past day 100 |
|---|---|---|---|---|---|
| Let's Encrypt | 7,579,074 | 100% | 0% | 0% | - |
| Amazon | 6,954,606 | <0.1% | 73.7% | 26.3% | 23.0% |
| DigiCert | 4,313,639 | 4.7% | 56.7% | 38.6% | 30.5% |
| Sectigo | 1,487,016 | 2.0% | 54.5% | 43.6% | 41.3% |
| GlobalSign | 1,155,893 | 7.3% | 56.0% | 36.7% | 28.0% |
| Microsoft | 961,548 | 39.0% | 56.7% | 4.4% | 2.7% |
| GoDaddy | 454,749 | 2.1% | 56.0% | 41.9% | 38.0% |
| Google Trust Services | 331,619 | 100% | 0% | 0% | - |
| Every other CA | 2,243,803 | 19.5% | 56.7% | 23.8% | 44.2% |

No host presents a Let's Encrypt or Google Trust Services certificate longer than 90 days, so all of theirs are already under next March's cap. For every other CA, the longest certificate it may issue halves again on March 15, 2027.

## Past day 100

![Bar chart of the 11.1 million IPv4 hosts on a browser-trusted certificate of 101 to 200 days on 2026-10-22, by the certificate's age in days: 3.1 million, 28.0%, were past day 100, where a 100-day certificate expires.](/blog/media/tls-200-day-certificate-age.2x.png)

Of the 11,101,236 hosts on a 101-to-200-day certificate, 3,111,164 (28.0%) were more than 100 days into it when we saw them, on 597,596 distinct certificates. A 100-day certificate issued the same day would already have expired on every one of them. From March 15, 2027 every new certificate is at most 100 days long, so a renewal that now comes after day 100 has to come sooner.

## Let's Encrypt's 64-day switch

![Bar chart of the 7.5 million IPv4 hosts on a 90-day Let's Encrypt certificate on 2026-10-22, by the certificate's age in days: about 117,000 at each day up to day 59, 50,329 at day 60 and about 14,000 at each day after; 303,967 were past day 64, where a 64-day certificate expires.](/blog/media/tls-lets-encrypt-certificate-age.2x.png)

7,474,376 hosts present a 90-day Let's Encrypt certificate. Up to day 59, each day of age holds about 117,000 of them. Day 60 holds 50,329, and each day after it about 14,000, so most renew by day 60.

303,967 hosts (4.1%) hold one more than 64 days old, which is a renewal too late for a 64-day certificate, and 401,837 (5.4%) are past day 60. Let's Encrypt's advice is to renew at about two-thirds of the lifetime, or let the CA say when through ACME Renewal Information ([RFC 9773](https://www.rfc-editor.org/rfc/rfc9773)), and to grep cron jobs, scripts and runbooks for hard-coded 83, 80 or 60.

Some hosts have already moved: 100,953 present Let's Encrypt's six-day certificate and 3,745 its 45-day one.

## Expired certificates

3,791,763 of the 37.3 million hosts on port 443 (10.2%) present an expired certificate, self-signed ones included. Of the 8,627,112 hosts presenting a Let's Encrypt certificate, 980,764 (11.4%) present an expired one: 410,582 expired more than a year before we saw them, 450,477 between 31 and 365 days before, and 119,705 (1.4% of Let's Encrypt's hosts) within the last 30 days.

## Checking your own ranges

[Web IP](https://internetdata.io/databases/web-ip) has every host on port 443 with its certificate's `cert_not_before`, `cert_not_after`, `cert_issuer_dn` and `cert_browser_trusted`, and the day it was last seen in `last_seen` ([schema](https://docs.internetdata.io/database/web-ip)). Filtered to the ranges you own or protect, a certificate of 101 to 200 days that's more than 100 days old (`last_seen` minus `cert_not_before`) is a renewal to bring forward before March 15. A Let's Encrypt certificate past day 64 is one to bring forward before February 10. A `cert_not_after` before `last_seen` is a server presenting an expired certificate now. Joined to [IP ASN](https://internetdata.io/databases/ip-asn) by address, the same filters count them by network, for a customer's or a vendor's space as well as your own.

## How we counted

Every figure is from Web IP's October 22 build, the IPv4 hosts on port 443, each as we last saw it. A host is an address, not a website. It presents the certificate it serves by default, and one certificate can sit on many addresses, as the distinct counts above show. A certificate's lifetime runs from `cert_not_before` to `cert_not_after`, and its age from `cert_not_before` to the day we saw the host. A trusted host is one whose `cert_browser_trusted` is set. The CA is the organization in `cert_issuer_dn`, with DigiCert's two spellings merged and GoDaddy's two. The [launch post](https://internetdata.io/blog/web-ip) shows what else a row holds.

## Getting access

Web IP is a gzipped CSV download, and [its docs](https://docs.internetdata.io/database/web-ip) list the columns. To license it, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).