Truvo Free Tools

Certificate lifetime checker

From March 15, 2027, public TLS certificates can last at most 100 days, and from March 15, 2029 at most 47. This checker reads public Certificate Transparency logs to show how long a domain's certificate lasts, how often a new one is issued, and whether renewal looks automated.

SOC 2 CC6.7ISO 27001 A.8.24

Last updated Oct 25, 2026, 11:00 UTC

Talk to a security specialist

Share what you need and a consultant will follow up to book a call.

How does the certificate lifetime checker work?

The check is passive: the checker never connects to the domain. Every publicly trusted certificate is recorded in Certificate Transparency logs, and the checker reads those public records.

01

Read

The checker looks up the certificates logged for the name in Certificate Transparency, through Cert Spotter with crt.sh as a fallback. Each record carries the issuing CA, the issue date and the expiry date.

02

Compare

The newest certificate's lifetime is compared with the CA/B Forum ballot SC-081 limits: 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. The gap between issue dates shows how often a new certificate appears.

03

Map

The result names the controls it speaks to: SOC 2 CC6.7 (protecting data in transit) and ISO 27001:2022 A.8.24 (use of cryptography). A long-lived, hand-renewed certificate is a finding to fix before the 100-day limit starts.

Renewing certificates by hand?

Truvo's certificate lifecycle management service finds every certificate you run, automates renewal before the 100-day limit starts, and leaves the evidence your SOC 2 and ISO 27001 auditors expect.

Talk to Truvo

  • Inventory every public and internal certificate

  • Automate renewal with ACME or your CA's tooling

  • Alert before any certificate expires

  • Map the process to SOC 2 CC6.7 and ISO 27001 A.8.24

Certificate lifetime checker: frequently asked questions

CA/B Forum ballot SC-081, approved in April 2025, lowers the longest a public TLS certificate can last to 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Certificates issued before each date keep the lifetime they were issued with.

Certificates of 100 days or less, a new certificate every 70 days or less, or an ACME certificate authority such as Let's Encrypt or Google Trust Services almost always mean a tool renews the certificate. Year-long certificates renewed once a year usually mean someone renews by hand.

CDNs such as Cloudflare keep certificates from more than one certificate authority for the same name as a backup, so several issuers for one domain is normal behind a CDN.

No. The checker reads Certificate Transparency logs and never contacts the domain, so the result shows what has been issued for the name. Internal hosts and private certificate authorities are not in public logs and cannot be checked here.

Move renewal to an ACME client or your certificate authority's automation, and list every certificate you own so none is renewed by hand. Truvo's certificate lifecycle management service covers the inventory, the automation and the evidence your auditor will ask for.