Who still renews certificates by hand? A monthly tracker before the 100-day limit

Wave of 2026-10-16 · next update around 2026-11-16 · measured by Hieu Tran with AI agents, from public Certificate Transparency logs

Public TLS certificates may be issued for at most 200 days today, 100 days from 15 March 2027 and 47 days from 15 March 2029 (CA/Browser Forum ballot SC-081). Let's Encrypt moves to 64 days on 10 February 2027. Automated renewal handles that; certificates bought and installed by hand need renewing about every three months. Every month we look up every current public certificate of the same 300 randomly chosen US local governments and colleges and count the ones that look renewed by hand.

Of 270 organisations in 45 states with a current public certificate, 147 have at least one that looks renewed by hand: 40 of 129 (31%); 95% interval 24–39% of local governments and 107 of 141 (76%); 95% interval 68–82% of colleges. Leaving out InCommon certificates (see below), they hold 1,461 such certificates, which under the new limits need 4,852 renewals in 2027, each one a chance for an outage if it is missed. InCommon certificates add 8,739 more at 28 colleges, if they are installed by hand. Totals are driven by a few large estates: five organisations hold 54% of the non-InCommon ones, while the typical organisation with any has 3. That's why the headline numbers count organisations, not certificates.

Local governments and colleges

28 of 141 colleges buy certificates through InCommon (Internet2's certificate service), and they hold 8,739 of the 10,082 likely-manual college certificates. InCommon also offers automated renewal (ACME with EAB), which public logs can't tell apart from manual installs, so colleges are shown with and without them.

Local governments (n=129)

Colleges (n=141)

Who issued the certificates renewed by hand

Commercial CAs whose certificates are usually bought per certificate and installed by hand. Groups with fewer than 3 certificates are folded into "other".

The certificate on the home page

We also opened one TLS connection to each organisation's home page (with and without www) and read the certificate it serves. 131 of 271 (48%) serve a Let's Encrypt certificate. 67 of 271 (25%) serve one issued for more than 100 days; from 15 March 2027 no CA may issue that, so each of those will be replaced by a shorter one, by automation or by hand. On the day, 1 of the 274 that answered served an expired certificate.

Method

• Panel. 300 organisations drawn at random (fixed seed) in October 2026: 150 of the 12,991 city, county and special-district domains in CISA's public .gov list, and 150 of the 4,059 active degree-granting US colleges in the federal IPEDS directory (2024), by the domain of their website. The same panel is re-measured every month, so changes are changes at the same organisations. Local governments on .org, .com or .us addresses aren't in the .gov list, so they aren't in the panel.
• Certificates. Every certificate valid on the day for the domain or any of its subdomains, from public Certificate Transparency logs through crt.sh's public database, one query at a time. Certificates for the same set of names count once (the newest). 294 of 300 domains could be looked up this wave: 6 of the largest universities have more certificates than crt.sh's public database could return in time, even split into smaller queries; they are left out, so college counts are, if anything, low. 24 had no current public certificate. A college campus whose website sits on its university's domain is measured as the whole domain.
• "Looks renewed by hand". Issued for more than 100 days by a CA that isn't a cloud provider's own (Amazon, Google, Microsoft, Cloudflare and others renew their certificates themselves). Certificates of 100 days or less are counted as automated. Renewals in 2027 assume renewal 14 days before expiry at the longest lifetime allowed on that date. This is the rule the free forecast uses.
• Home page. One TLS handshake each to the domain and its www host, with server name indication, reading the served certificate without validating it; www is used when its name matches.
• How it's made. AI agents built and ran the lookups; every number is computed by a script from the CSVs below, with the same engine as the free forecast.
• What it doesn't say. Logs show which certificates were issued, not how they are installed. Some long-lived certificates are renewed automatically (ACME with EAB at commercial CAs, InCommon, hosting providers that manage them), so "looks renewed by hand" is an upper bound for that reason, while internal certificates from private CAs aren't in public logs at all. A certificate may also be issued but no longer in use. Intervals are 95% Wilson intervals over organisations.

Data

CC BY 4.0. One row per organisation and one row per certificate, with group, type, state, issuer, lifetime and renewals. Names, domains and hostnames are left out on purpose: this is about how organisations run certificates, not about any one of them. Organisation numbers are per wave, not stable ids.

• t02-tracker-2026-10-16-organisations.csv
• t02-tracker-2026-10-16-certificates.csv

Cite as: Cert Renewal Forecast, "100-day certificate readiness tracker", wave of 2026-10-16, https://opsfixes.com/cert-renewal-forecast/tracker/