Server software · checked November 15, 2026

Is nginx / Apache with a purchased certificate ready for 100-day and 47-day certificates?

Manual: you renew it

Not on its own. With nginx / Apache with a purchased certificate, each new certificate has to be obtained and installed, either by you or by an ACME client you set up. From March 15, 2027 that’s at least every 100 days.

What renews automatically

Apache mod_md can manage ACME certificates itself: MDRenewWindow defaults to 33% of lifetime, and MDRenewViaARI is on by default.[Apache Software Foundation]
nginx's ngx_http_acme_module gets certificates over ACME and can request a specific certificate profile.[nginx]

What doesn’t

A purchased certificate installed by hand has to be reissued, validated and installed every cycle. From March 15, 2027 that's at least every 100 days.[CA/Browser Forum]

When it renews

Unknown: nginx / Apache with a purchased certificate doesn’t say how far ahead it renews.

What to do, and by when

March 15, 2027 · In 120 days
Maximum certificate lifetime drops to 100 days[CA/Browser Forum 1 (CA/Browser Forum — Baseline Requirements for TLS Server Certificates (v2.3.1, 4 Oct 2026)), 2 (CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods)]
Automate before your first renewal after this date: mod_md, the nginx ACME module, Certbot, or an automated paid certificate.
March 15, 2028 · In 486 days
Email domain validation (admin@, webmaster@ …) ends[CA/Browser Forum]
Stop relying on email validation (admin@ / webmaster@) before this date.

Steps

Check whether you need a purchased (OV/EV) certificate. If not, use a free ACME certificate.
Apache: enable mod_md and add an MDomain for your site.
nginx: use the ngx_http_acme_module or Certbot.
If you keep a purchased certificate, ask your CA or reseller about ACME support.

Your options, free first

Free: use a free ACME client with Let’s Encrypt (for example win-acme on Windows, or Certbot, Apache mod_md or nginx’s ACME module on Linux) so certificates renew and install themselves.
An automated paid certificate, if you need a paid one (for example OV/EV): choose a seller whose certificates install themselves (ACME or an install agent).
- Namecheap SSL (with SSL Manager / SSL Proxy automation)[Namecheap]
A host with built-in automatic SSL, if your current host can’t automate:
- Hostinger (free Lifetime SSL on web, cloud and agency plans)[Hostinger]

No links here are paid. If that ever changes, they will be marked “Sponsored” and never change the order. Disclosure.

Not published by nginx / Apache with a purchased certificate

When ngx_http_acme_module renews: not stated on its reference page.

We re-check these every month.

Questions

How often will I have to install a purchased certificate?

At least every 100 days from March 15, 2027 and every 47 days from March 15, 2029, because that's the maximum lifetime.

Sources

Apache HTTP Server — mod_md (Apache Software Foundation, accessed November 15, 2026)
CA/Browser Forum — Baseline Requirements for TLS Server Certificates (v2.3.1, 4 Oct 2026) (CA/Browser Forum, accessed November 15, 2026)
nginx — Module ngx_http_acme_module (nginx, accessed November 15, 2026)

Facts on this page last checked November 15, 2026.