Automated issuance
Some authorities issue certificates automatically over a protocol called ACME, which lets a server request and renew certificates without a person. Let’s Encrypt is a well-known example, and it has published a plan to move its default certificate lifetime from 90 days to 64 days in February 2027 and 45 days in February 2028. Commercial authorities sell certificates with other validation levels and support.
What matters for a client site
The authority matters less than the process: who renews, how, and whether anyone notices when it stops. Renewal often fails after a DNS or hosting change because the validation request goes to the wrong place. A CAA record in DNS can also restrict which authorities may issue for a domain, and a forgotten CAA record can block a new provider.
How to see who issued a certificate
Open the site in a browser and view the certificate details, or run openssl s_client -connect example.com:443 -servername example.com and pipe the output to openssl x509 -noout -issuer -enddate. A change of issuer on a site nobody touched is worth a question: the host may have moved the site, switched on a CDN’s managed certificate or moved to automated issuance. Also run dig CAA example.com: when CAA records exist, only the authorities they name may issue certificates for that domain.
What to check
The issuer name on the certificate, the renewal method and the owner, and any unexpected change of issuer, which can mean a hosting or CDN move.
Sources
Read on . Standards and vendor pages change; confirm the current text before you rely on it.
- Let’s Encrypt: Decreasing Certificate Lifetimes to 45 Days (letsencrypt.org)