Short-Lived SSL Certs: What Changes for Your cPanel Site

If you've noticed your cPanel server's SSL certificates renewing more often than they used to — or you've seen "short-lived certificate" mentioned in a Let's Encrypt changelog and wondered if you need to do anything — you're not missing an update you forgot to install. The industry is genuinely shortening how long a TLS certificate stays valid, and it changes a few things behind the scenes even when AutoSSL keeps humming along without a single support ticket.

This post explains what "short-lived certificates" actually means, why cPanel users mostly don't need to panic, and the handful of setups where it does bite.

Symptom: Certificates Renewing Every Few Days Instead of Every Few Months

A few things prompt this question from customers:

• WHM's SSL Storage Manager or /var/cpanel/ssl/ shows a fresh certificate issue date every 6-10 days for domains that used to sit at 90 days.
• A monitoring tool (UptimeRobot, a custom cert-expiry cron job, an internal dashboard) starts firing "certificate expires soon" alerts constantly, because it was tuned around a 90-day lifetime.
• Someone on the team asks why the domain's cert history in AutoSSL looks "spammy" compared to last year.
• A purchased (non-AutoSSL) certificate from a CA reseller still shows the old 1-year validity, but the free AutoSSL cert on the same server clearly doesn't match that pattern anymore.

None of this means your server is broken. It means Let's Encrypt — the certificate authority AutoSSL uses by default — now offers, and increasingly defaults to, certificates with a roughly 6-day lifetime instead of the traditional 90 days.

Cause: The CA/Browser Forum Is Shrinking Certificate Lifetimes Industry-Wide

This isn't a Let's Encrypt-only quirk. The CA/Browser Forum — the body that sets the baseline rules every public certificate authority has to follow — voted to progressively shorten maximum TLS certificate validity over the next several years, moving from the old 398-day cap down toward validity measured in weeks, not months. Let's Encrypt built support for 6-day certificates ahead of that curve and made them available as an issuance profile.

Why shorter-lived certificates at all?

Three reasons keep coming up whenever this is discussed:

• Revocation is broken in practice. Revoking a compromised long-lived certificate depends on browsers checking OCSP or CRLs reliably, and most don't, consistently. A certificate that expires in 6 days limits how long a compromised key stays useful, with or without revocation working.
• It forces automation. A 90-day cycle is long enough that plenty of teams still do it by hand, forget it, and get paged when it expires. A 6-day cycle is only survivable with full automation — which is exactly the behavior CAs want to push the whole web toward.
• Shorter certs reduce the blast radius of CA mistakes. If a certificate authority mis-issues a batch of certificates, a 6-day lifetime means the bad certs age out fast instead of lingering for a year.

Fix: What Actually Changes for a cPanel Server

If you use AutoSSL (the default), you likely don't need to do anything

AutoSSL already runs on its own schedule, checking certificates roughly every day and renewing well before expiry. Whether the underlying certificate is valid for 90 days or 6 days, AutoSSL's renewal logic doesn't care — it just renews whenever a cert is inside its renewal window. Your visitors never see a gap either way, because renewal and reissuance are fully automated at the panel level.

Check which profile your server is actually using:

# From root SSH, check the AutoSSL provider and certificate details for a domain
whmapi1 fetch_autossl_config
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null   | openssl x509 -noout -dates

If notBefore and notAfter are roughly 6 days apart, your server is already on a short-lived issuance profile. If they're ~90 days apart, you're still on the classic profile — also fine, no action required unless you want to move sooner.

Where it actually causes friction

If you manage certificates manually (not AutoSSL)

If your workflow is "buy a cert from a reseller, upload it in cPanel's SSL/TLS interface once a year," short-lived Let's Encrypt certificates don't affect you directly — commercial CAs are on their own, slower validity-reduction timeline set by the same CA/Browser Forum ballots, and a purchased certificate still lasts however long you bought it for. The relevant question is whether you want to keep managing it manually as the industry norm shifts toward days, not months. Most admins in that position eventually switch the domain to AutoSSL and let cPanel handle it, precisely because manual renewal on a 6-day cycle isn't realistic.

# Switch a domain from a manually-installed cert to AutoSSL coverage
# WHM > SSL/TLS Status > select the domain > Run AutoSSL
# or via API:
whmapi1 start_autossl_check --output=jsonpretty user=cpaneluser

Prevention: Build for Days, Not Months

• Audit anything outside cPanel that reads certificate expiry dates. Cron jobs, monitoring configs, CI/CD deploy scripts — anywhere a human once wrote "90" as a magic number is a place that will misbehave.
• Let AutoSSL own the renewal, don't fight it with a parallel script. Two systems renewing the same certificate on different schedules is how you get race conditions and confusing SSL/TLS Status pages.
• Set monitoring thresholds relative to hours, not weeks, for any domain on a short-lived profile. "Alert if renewal hasn't happened in the last 24 hours" is more useful than "alert if expiry is within 30 days."
• Double-check CAA records on domains that renew frequently — a misconfigured CAA record that silently blocks issuance is far more disruptive on a 6-day cycle than a 90-day one, because you have far less runway before the certificate actually lapses.
• Don't hardcode certificate lifetime assumptions in any tooling you write going forward. Read notBefore/notAfter dynamically instead of assuming a fixed duration.

The short version: if your site sits behind cPanel's AutoSSL and you haven't touched it, this whole shift is invisible to you. The certificates just rotate faster and nobody notices. The risk is entirely in the tooling built on top of the old assumption that a certificate lasts three months — and that's worth a five-minute audit before it becomes a 2 a.m. page.