One-Year SSL Certificates Are Gone: We Read 37 Sites

The ratified schedule

That third column gets less attention and will cause more pain. Domain validation reuse is how long the CA may lean on the last time you proved you control the name. Prove it once today and the proof is good for up to 398 days of future issuance. In 2029 it becomes 10 days, which in practice means proving ownership again on almost every renewal.

What 37 Iranian sites actually look like today

We wanted to know whether the cap had reached the market we work in, so on 15 August 2026 we read the certificate of 37 sites. The list was not cherry-picked. Eighteen are hosting and infrastructure companies that rank for the Persian queries for SSL certificates and virtual servers; nineteen are SEO, tooling and marketing sites pulled from two other live result pages. Anyone can repeat it:

openssl s_client -connect example.com:443 -servername example.com < /dev/null \
  | openssl x509 -noout -issuer -startdate -enddate

The lifetime is the gap between notBefore and notAfter. Three clean groups came out:

Twenty-seven of the 37 certificates were issued on or after 15 March. Not one exceeds 198 days. The cap is not a plan; it is already being enforced, and this is what enforcement looks like from the outside.

The ten long certificates were every one of them issued before the cutoff. The longest belongs to yektanet.com and was issued on 2 March 2026, twelve days before the rule took effect. Those last one-year certificates went out in a narrow window and they are all expiring within months.

Two renewals that prove the point

Respina renewed on 4 April and Sindad on 29 April, both after the cap. Both landed on exactly 198 days.

198 is not a round number and nobody chose it. It is 200 minus the margin a CA leaves for clock skew. When two unrelated companies buying from the same authority arrive at an identical figure, that figure is policy rather than coincidence. This is the only direct evidence we could find that the change has landed commercially in Iran, and it took reading certificates to see it.

The CA selling those long certificates voted for this

Seven of the ten long certificates came from one authority: Certum, which appears in the certificate as Asseco Data Systems. That same company voted in favour of the reduction at the CA/Browser Forum.

We are not pointing that out to score a point. It matters because it tells you nobody is going to stop this. When the vendor selling the certificate and Apple, Google, Microsoft and Mozilla all agree, the only remaining variable is whether your renewal is automated.

What to do about it

If you renew your certificate by hand, that habit is finished. An annual calendar reminder was survivable. From 2029 it becomes roughly eight renewals a year, and missing one puts a full-page browser warning in front of every visitor you have.

Three things worth checking today. How long is your current certificate and when does it expire. Whether renewal is automatic or someone has to do something. And, if it is automatic, when it last actually renewed on its own, because automatic on paper and automatic in production are different claims.

Our own site runs a 90-day Google Trust Services certificate issued on 31 July. We mention it as disclosure rather than advice: we sit in the same 90-day group as most of the sample, so the 200-day rule changed nothing for us.

Who can ignore all of this

If you are on shared hosting with cPanel or DirectAdmin and using the free certificate the panel provisions, you probably need to do nothing at all. Those certificates are already 89 or 90 days and the panel renews them without being asked. Twenty-five of the 37 sites we read are in exactly that position.

Two groups should pay attention. Anyone who bought a certificate and installed it manually. And anyone whose certificate lives somewhere other than the web server, on a load balancer, a network appliance or pinned inside a mobile app, where no renewal daemon can reach it.

The part nobody can test yet

Nobody knows how well hosting control panels will cope with a 47-day cycle, because it does not arrive until 2029 and there is no way to try it early. The 100-day step lands in March 2027, and that is the first real trial. Anyone telling you today that their stack is ready for 47 days is describing an intention, not a test result.

Questions people actually ask

What does an SSL certificate cost? For most sites, nothing. Free and paid certificates are cryptographically identical and browsers treat them the same way. The difference is the validation type, which we go through in the differences between SSL certificate types, and there is live pricing for every SSL certificate type on our service page.

How do I renew it? If your host issued it, renewal is automatic and your only job is to confirm once that it works. If you bought it, you generate a new request and install the new certificate, and from this year you do that more often than you used to.

Are multi-year certificates still sold? No, and they have not been legal for years. What is sold is a multi-year subscription under which a series of short certificates is issued. The new caps increase how many, not how long each one lasts.

If you are not sure which row of that table your site is in, read the certificate yourself; it takes one command. If you would rather not think about the cycle at all, hosting with automatic certificate renewal is how we run our own servers, and it is the reason this article is a notification for our clients rather than an emergency. New builds get it configured from day one too, whether we are building the site from scratch or taking one over. Every number above comes from the text and result of ballot SC-081v3 and the CA/Browser Forum Baseline Requirements. The 37-site measurement was taken on 15 August 2026; repeat it now and the long-certificate sites have probably renewed.