Published On:
November 05, 2026
Published By:

Greg Borbonus

Shorter SSL Certificates: What Sectigo's 2026 Report Means for You

On 28 October 2026, Sectigo released its 2026 State of Crypto Agility report. For you, the useful part is the padlock on your website. A publicly trusted SSL/TLS certificate is the file that shows visitors they are on your real site and keeps the connection private. Sectigo says those certificates are already limited to 200 days, and that they are scheduled to fall to 100 days in March 2027 and to 47 days in March 2029. What used to be a long renewal window is now a shorter one.

I can watch the site for you while the renewal plan comes together. Website monitoring is $5 a month, and you can reach me at greg@ableadmins.com. If the site stops answering, you hear it from me. The dates and survey figures in this note come from Sectigo's release of 28 October 2026, and from SecurityBrief UK on 4 November 2026.

What shorter certificates mean for your site

Sectigo's press release says the maximum validity period for publicly trusted SSL/TLS certificates fell from 398 days to 200 days in March 2026. That cap is already in effect. The same release schedules 100 days for March 2027, a little over three months, and 47 days for March 2029, about a month and a half. Each renewal covers less time, so the date belongs where you can see it.

Any public site your customers open is part of this. A brochure site, a checkout, a booking page, and a client login each have a certificate. Other names on the same domain count too, such as a shop address or a portal. When a host or a certificate company already renews yours, ask for the date in writing, and ask who is told if that renewal fails.

Crypto agility is the name Sectigo uses for changing certificates, and the cryptography under them, on a short timetable. Cryptography is the math that keeps a connection private. The part you need is plain. Know the expiry. Know who renews it. Make sure a failed renewal reaches a person who will act.

If you would like me watching the site while you collect those dates, website monitoring is the place to start.

What the survey reported

Censuswide collected 500 responses from C-level, vice-president, and director-level leaders in IT, technical operations, cybersecurity, and risk. Sectigo says year-over-year comparisons are directional, because the 2026 sample expanded to include APAC. APAC means Asia-Pacific.

The release says 62% of respondents report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025. An inventory is a written list of each public certificate, the website name it covers, and the day it expires. One company site may need only a few lines. The lines still need a home you can open on a normal day.

On monthly renewals, 40% are very prepared because automated systems are already in place, up from 19%. The release also says 73% plan to increase certificate-management automation because of shorter lifespans. Automation, here, means a system performs the renewal and a person steps in when that system sends a problem report.

Sectigo says 61% experienced a certificate-related outage or incident in the past 12 months. SecurityBrief UK repeats that figure on 4 November 2026, along with the move from 398 days to 200 days, the 40% who are very prepared for monthly renewals, and the 73% who plan to increase automation. Those are the published figures. Your own expiry list will show you where your sites stand.

When you also want a check that the site is responding, I can do that through website monitoring.

A quiet review for this week

Send a short note to the person who looks after the website. Ask for three written answers.

  • The expiry date on your main website, and the expiry date for every other public name customers use.
  • Who renews each certificate, and whether the renewal runs on its own.
  • Where a failure notice goes, and who reads it.

Keep the reply somewhere easy to find next quarter. When March 2027 moves the public maximum to 100 days, you will know which names need a shorter cycle. If a date falls inside the next two months, ask them to renew now and to send the new date when the work is done. If the date is still unknown, finding that date is the task to start with.

Once a certificate passes its end date, a visitor can see a browser warning in place of your page. A written date, renewed ahead of time, keeps the visit ordinary.

I am glad to keep an eye on whether the site stays reachable while you gather those dates. Start at website monitoring.

How Able can help

Website monitoring is $5 a month. It watches your site so you hear when the site stops responding to visitors. Keep the certificate list, and name the person who owns each renewal. Email greg@ableadmins.com with the site address and I will set it up with you and confirm when it is running.

Sources

Whenever you want the site watched, you can start website monitoring, or write me at greg@ableadmins.com and I will help you begin.