In short: Certificate management software discovers your SSL/TLS certificates, shows when each expires and automates issuance and renewal, often using the ACME protocol. It matters more each year: public TLS certificates are limited to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Licensing is usually by certificate count or domain.
Why certificate management matters now
SSL/TLS certificates secure your websites, portals, email servers and APIs. When one expires, visitors see a security warning, integrations break and email can fail.
The industry rules are changing. In April 2025 the CA/Browser Forum, which sets the rules for publicly trusted certificates, approved Ballot SC-081, which reduces the maximum lifetime of public TLS certificates in stages:
| From | Maximum certificate lifetime |
|---|---|
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
The period for which a certificate authority can reuse earlier domain validation is shortening too. In practice, organisations that renew certificates by hand, once a year, will soon be doing it every few weeks. Automation is the only sensible answer.
Shorter lifetimes are meant to improve security: if a key is compromised or a certificate is issued in error, the damage window is smaller. The cost is operational, because every certificate you own will need renewing far more often.
Certificate management: vendors and products we supply
- EasyDMARC Managed BIMI: Your logo in supporting inboxes, with the BIMI record and assets hosted for you.
- Sectigo: Automated public TLS certificates, standard and wildcard, through Sectigo Certificate Manager.
- Sectigo Certificate Manager: Automated DV and wildcard TLS certificates with discovery, ACME renewal and expiry alerts.
What certificate management software does
- Discovery: finds certificates across your domains and networks, including ones nobody remembered buying
- Inventory and alerts: one dashboard of every certificate, its owner and expiry date
- Automated issuance and renewal, commonly through the ACME protocol, with agents or integrations installing the certificate on web servers, load balancers and cloud services
- Revocation and replacement when a key is compromised or a certificate authority is distrusted
- Policy control: approved certificate types, key lengths and who may request certificates
Sectigo Certificate Manager is one example, covering the issuance, renewal and revocation of public certificates from a central console.
It also helps to keep certificate ownership in the hands of the organisation rather than individuals. Certificates bought on a personal card, or by a web developer who has since moved on, are a common cause of unexpected expiries. A central account, with renewal alerts going to a shared mailbox, avoids that. For internal systems, the same tools can often manage certificates from a private certificate authority, giving you one view of everything that might expire.
How certificate management is licensed
Certificate products are licensed in several ways: per certificate, per domain, by certificate type (domain validated, organisation validated or extended validation), or as a platform subscription that includes a number of certificates. Subscriptions usually run for a year or more and cover as many renewals and reissues as the shorter lifetimes require within the term.
How to choose
- Inventory what you have: public websites, mail servers, VPN gateways, internal services and cloud load balancers.
- Check which systems support ACME or automated installation, and which will need manual steps or replacement.
- Decide on certificate types; most sites need only domain-validated certificates.
- Assign owners and alerting so nothing expires silently.
- Plan for the 100-day limit in March 2027, not just today's 200 days.
How we help
We supply certificate management subscriptions on your Forever Systems account, help you build an inventory and set up automation for the systems that support it. Contact us and ask us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How long do SSL certificates last now?
Publicly trusted TLS certificates issued from 15 March 2026 can be valid for a maximum of 200 days. The limit falls to 100 days from 15 March 2027 and to 47 days from 15 March 2029.
What is ACME?
ACME (Automatic Certificate Management Environment) is a standard protocol that lets servers request, validate and install certificates automatically, so renewals happen without manual work.
Do internal certificates have to follow the new limits?
The CA/Browser Forum rules apply to publicly trusted certificates. Certificates from your own private certificate authority follow your own policy, though automation is still good practice.