CDN · checked November 15, 2026

Is Cloudflare ready for 100-day and 47-day certificates?

Renews automatically

Cloudflare’s own certificates renew automatically, so the shorter lifetimes (100 days from March 15, 2027, 47 days from March 15, 2029) are handled for you, with the exceptions below.

What renews automatically

• Universal certificates are valid 90 days and renewal starts 30 days before expiry. Retries continue until 24 hours before expiry.[Cloudflare]
• Cloudflare picks the CA for Universal certificates (Let's Encrypt, Google Trust Services or SSL.com).[Cloudflare 1 (Cloudflare Docs — Validity periods and renewal), 2 (Cloudflare Docs — Certificate authorities)]

What doesn’t

• Cloudflare can't renew custom certificates you upload. It emails reminders 30 and 14 days before they expire.[Cloudflare]
• An uploaded certificate must have at least 14 days left at upload time.[Cloudflare]

When it renews

Universal: 30 days before expiry. Advanced 1-month and 2-week certificates: 7 and 3 days.[Cloudflare]

What to do, and by when

1. March 15, 2027 · In 120 days
   Maximum certificate lifetime drops to 100 days[CA/Browser Forum 1 (CA/Browser Forum — Baseline Requirements for TLS Server Certificates (v2.3.1, 4 Oct 2026)), 2 (CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods)]
   If you upload a custom certificate to Cloudflare, consider a Universal or Advanced certificate instead before your first renewal after this date.

Steps

1. In the Cloudflare dashboard, go to SSL/TLS > Edge Certificates and check which certificates are active.
2. If only Universal or Advanced certificates are listed, Cloudflare renews them.
3. If a custom certificate is uploaded, either replace it before it expires (Cloudflare emails 30 and 14 days ahead) or remove it and rely on the Universal certificate.
4. Check your origin server's own certificate separately. A Let's Encrypt client or your host's automatic SSL usually covers it.