The padlock on your website comes with an expiry date

The padlock beside your website's address rests on a certificate, and that certificate has an expiry date. Today it can last 200 days at most. From 15 March 2027 the limit drops to 100 days, and from 15 March 2029 to 47 days. The biggest supplier of these certificates, Let's Encrypt, stopped emailing expiry reminders on 4 June 2025. Renewal has to be automatic.

Most of us also read the padlock as "this site is safe". It does not say that either.

The limit falls to 47 days by March 2029

In April 2025 the CA/Browser Forum, where certificate issuers and browser makers set the rules, voted on a schedule to shorten certificates. Issuers voted 25 for, none against, five abstaining. Apple, Google, Microsoft and Mozilla all voted for.

The longest a certificate may last:

• 398 days, until 15 March 2026
• 200 days, from 15 March 2026 (the rule today)
• 100 days, from 15 March 2027
• 47 days, from 15 March 2029

Let's Encrypt already issues 90-day certificates by default. In 2015 it explained why: shorter lifetimes "limit damage" if a certificate is stolen or issued by mistake, and "encourage automation". It plans to cut its default to 64 days on 10 February 2027 and 45 days on 16 February 2028.

The padlock does not vouch for the business

Browsers have shown a padlock since the early versions of Netscape in the 1990s. In June 2019 the FBI warned: "Do not trust a website just because it has a lock icon or "https" in the browser address bar."

Google's Chrome team went further in May 2023. "We know that the lock icon does not indicate website trustworthiness," it wrote, and "nearly all phishing sites use HTTPS, and therefore also display the lock icon." Its research in 2021 found that only 11% of participants correctly understood what the icon means. Chrome announced it would replace the padlock with a "tune" icon that, it said, does not imply "trustworthy", and that it would keep warning people when a connection is not secure. Since July 2018, Chrome has marked every site without a certificate "not secure".

A free certificate proves control of the address, not who owns it

1. A website asks a certificate authority, an organisation that browsers trust, for a certificate.
2. The authority checks that the applicant controls the web address. Let's Encrypt does this in software: it asks the site to publish a specific file, or to add a specific entry to the address's settings, and checks it from several places on the internet.
3. Your browser checks the certificate and encrypts the connection, so others on the network cannot read what passes.
4. The certificate expires on a set date and has to be replaced.

Let's Encrypt only checks control of the address. It does not offer the kinds of certificate that check a company's identity, "primarily because we cannot automate issuance for those types".

Most of the web gets its certificate free

According to a W3Techs count on 7 October 2026, Let's Encrypt is used by 64.3% of all websites.

It issued its first certificate on 14 September 2015, and was started by people from Mozilla, the Electronic Frontier Foundation and the University of Michigan. Josh Aas, a founding director of the non-profit behind it, described the problem in 2014: "The application process can be confusing. It usually costs money. It's tricky to install correctly. It's a pain to update."

It does not charge for certificates, though a hosting company may add "a nominal fee". The non-profit is the Internet Security Research Group, founded in the US in May 2013. Let's Encrypt says it now serves more than 700 million websites.

In a 2020 letter, Aas wrote: "When your strategy as a nonprofit is to get out of the way, to offer services that people don't need to think about, you're running a real risk that you'll eventually be taken for granted."

The renewal method is a public standard

The method a server uses to ask for and renew a certificate with no human involved is called ACME. It became a public standard, RFC 8555, in March 2019. Let's Encrypt says a shared standard makes it easier to switch from one certificate authority to another.

Let's Encrypt calls Certbot the most commonly used ACME tool. Certbot is free, open-source software made by the Electronic Frontier Foundation, not by Let's Encrypt, and its own page says many owners will not need it: "Many hosting providers have internal tools to enable HTTPS."

Renewal has to be automatic

When a certificate runs out, browsers show visitors a warning instead of your website. W3Techs counted 0.6% of websites with an expired certificate on 7 October.

Let's Encrypt will not remind you. It ended its expiry reminder emails on 4 June 2025 and deleted the addresses it held. It says most users who renew automatically "will not have to make any changes", but "should verify" that their setup copes with shorter certificates.

Ask whoever runs your website, whether an agency, a freelancer or your hosting company, two questions. Is our certificate renewed automatically, or does someone do it by hand? And when renewal fails, who gets told?