Discuss your project

TOOLBOX · DOWNLOAD

Certificatesthat renewthemselves.

Since March 15, 2026, public TLS certificates have been valid for at most 200 days; from March 2029, only 47 days, and domain validation will then be valid for only 10 days. Anyone who renews certificates by hand will have an operational problem. This checklist covers protocols, cipher suites and keys according to BSI TR-02102-2 (version 2026-01) and TLSRef, automation with ACME, inventory and expiry monitoring, HSTS, CAA, internal services and revocation checking after the end of OCSP at Let’s Encrypt. It also includes sample configurations for nginx and Apache and test commands with OpenSSL.

Download PDF (12 pages)What Is Inside

Free PDF · Checklist

TLS and Certificates: Checklist for Servers and Websites

Topic
Website & Data Protection
Format
PDF, A4
Length
12 pages
Size
165 KB
Updated
Oct 25, 2026
Sources
24
Usage
Redistribution in unchanged form permitted
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Protocols, keys, validity down to 47 days, ACME, inventory, HSTS and CAA according to BSI TR-02102-2, the CA/Browser Forum and the IETF, with configuration and test commands.

  • Administrators of web, mail and VPN servers, reverse proxies and load balancers
  • Web agencies and hosting providers that run websites and certificates for customers
  • Website owners and IT management who need to keep track of certificates, service providers and deadlines

9 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What this is about and what is required

    Why certificates are getting shorter lifetimes, what the NISG 2026 (Austrian Network and Information Systems Security Act 2026) requires and what is only a recommendation.

  • 02

    Validity periods: the phased plan to 2029

    Maximum validity and domain validation decrease in three steps; the first has applied since March 15, 2026.

  • 03

    Protocols, cipher suites and keys

    Prefer TLS 1.3, TLS 1.2 only with forward secrecy, turn off anything older, choose keys correctly.

  • 04

    Automating with ACME

    Request, domain validation and renewal without manual work, with monitoring.

  • 05

    Inventory and expiry monitoring

    Record every certificate with expiry date and owner and monitor it from the outside.

  • 06

    Enforcing HTTPS: redirect, HSTS and CAA

    Redirect HTTP permanently, introduce HSTS in stages, use CAA to define the issuers.

  • 07

    Sample configuration and test commands

    nginx and Apache based on TLSRef Intermediate, Windows Server and test commands with OpenSSL.

  • 08

    Internal services and revocation checking

    Do not forget mail, VPN and devices; what has changed with OCSP and CRLs.

  • 09

    Checklist to tick off

    All points in one list to tick off.

EXCERPT

Validity periods: the phased plan to 2029

Phased plan under Ballot SC-081v3 (Baseline Requirements 2.3.1, Sections 6.3.2 and 4.2.1)
Certificate issuedMaximum validityMaximum domain validation reuse
before Mar 15, 2026398 days398 days
from Mar 15, 2026 (applies now)200 days200 days
from Mar 15, 2027100 days100 days
from Mar 15, 202947 days10 days

CAs should stay one day below each limit (199, 99, 46 days), because a day has 86,400 seconds and even fractions beyond that count as another day (Section 6.3.2). Since March 15, 2026, validated organization information for OV certificates may be reused for at most 398 instead of 825 days (4.2.1); for EV, the EV Guidelines (3.2.2.14.3) have already set a maximum of 398 days since 2021. SC-081v3 was adopted on April 11, 2025, without any votes against.

  • At 47 days, every name needs at least eight certificates a year, and at 10 days domain validation is practically due again every time. Let’s Encrypt advises against manual renewal; validation must also run automatically (section 04).
  • In case of a compromised key and some other reasons, such as unreliable domain validation, the CA must revoke within 24 hours, in other cases within 5 days (Section 4.9.1.1). So a replacement must be possible at short notice at any time.

Let’s Encrypt is shortening sooner (announcement of December 2, 2025): tlsserver profile with 45 days since May 13, 2026; classic default profile with 64 days and 10 days of domain validation reuse from February 10, 2027 (confirmed on October 7, 2026), and with 45 days and 7 hours from February 16, 2028; shortlived profile with about 6 days.

Get the Full PDF

SOURCES

Supported
by Sources.

  1. BSI TR-02102-2: Use of TLS, version 2026-01 (opens in a new tab)PDF of January 27, 2026: chap. 1, 3.2 to 3.6, 4.1; note on TLS 1.3 (RFC 10024) on the page
  2. CA/Browser Forum: TLS Baseline Requirements 2.3.1 (opens in a new tab)of October 4, 2026; 1.1, 1.2.2, 3.2.2.4, 4.2.1, 4.2.2, 4.9, 6.1.5, 6.3.2, 7.1.2
  3. CA/Browser Forum: EV Guidelines 2.0.4 (opens in a new tab)August 13, 2026; 3.2.2.14.3 (398 days since SC042, 2021)
  4. CA/Browser Forum: Ballot SC-081v3 (opens in a new tab)Phased plan, vote of April 11, 2025
  5. RFC 9846: TLS 1.3 (replaces RFC 8446) (opens in a new tab)July 2026; Sections 1.2 and 1.3
  6. RFC 8996: Deprecating TLS 1.0 and TLS 1.1 (opens in a new tab)Sections 4 and 5
  7. RFC 9325 (BCP 195): Secure Use of TLS (opens in a new tab)Sections 3.1.1, 3.2, 3.3, 4.1 and 4.5
  8. RFC 9852 and RFC 10015 (July 2026): amendments to RFC 9325 (opens in a new tab)9852: 4, 5; 10015: 2 to 4, 6 (www.rfc-editor.org/rfc/rfc10015.html)
  9. RFC 10024: PQ/T Hybrid Key Agreement for TLS 1.3 (opens in a new tab)August 2026; X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024
  10. RFC 8555: ACME (opens in a new tab)Sections 8.3 and 8.4
  11. RFC 8737: ACME TLS-ALPN-01 (opens in a new tab)Section 3
  12. RFC 9773: ACME Renewal Information (ARI) (opens in a new tab)Section 1
  13. RFC 6797: HSTS (opens in a new tab)Sections 6.1, 7.2, 8.4 and 12.1
  14. RFC 8659 and RFC 8657: CAA (opens in a new tab)8659: 3, 4.1 to 4.4; 8657: 4, Appendix A (www.rfc-editor.org/rfc/rfc8657.html)
  15. RFC 6962: Certificate Transparency (opens in a new tab)experimental, formally replaced by RFC 9162; summary
  16. TLSRef Configurator (formerly Mozilla) and guidelines 6.0 (opens in a new tab)nginx and Apache templates (build 6bcb595); docs.tlsref.org/server-side-tls.html; move: github.com/mozilla/ssl-config-generator
  17. Let’s Encrypt: End of OCSP (opens in a new tab)August 6, 2025; timeline in the post of December 5, 2024
  18. Let’s Encrypt: Validity down to 45 days (opens in a new tab)December 2, 2025; timeline, profiles, ARI, monitoring; confirmed in letsencrypt.org/2026/10/07/64-day-certs
  19. OpenSSL 3.5: Documentation (opens in a new tab)s_client, x509, ciphers, SSL_CTX_set_security_level
  20. Microsoft Learn: Protocols in TLS/SSL (Schannel SSP) and TLS registry settings (opens in a new tab)Versions per Windows release; registry: learn.microsoft.com/de-de/windows-server/security/tls/tls-registry-settings
  21. hstspreload.org: Deploying HSTS, preload (opens in a new tab)accessed October 25, 2026
  22. NISG 2026, BGBl. I No. 94/2025 (RIS) (opens in a new tab)§ 32 and § 51 para. 2; version of October 25, 2026
  23. NISV 2026, BGBl. II No. 290/2026 (RIS) (opens in a new tab)§ 2
  24. IR (EU) 2024/2690, Annex point 9 (opens in a new tab)Cryptography; applicable under § 2 NISV 2026

This checklist is a TOMORIS recommendation based on the sources listed, as of October 25, 2026. For certification authorities, the Baseline Requirements as currently in force are binding; for essential and important entities, the NISG 2026; BSI TR-02102-2 is a recommendation. It does not replace legal advice. Default values and names may change. Test changes in a test environment first; overly strict settings can lock out older clients.

TOOLBOX

Explore
Further.

WEBSITE & DATA PROTECTION

More on
This Topic.

More free PDFs about Website & Data Protection.
All Website & Data Protection Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads