SSL certificate lifetimes are shrinking: 200, then 100, then 47 days
Checked against the CA/Browser Forum's ballot and the current TLS Baseline Requirements (version 2.3.1, 4 October 2026) on (checked 2026-10-19); sources at the end.
Browsers only trust a public TLS certificate if the certificate authority followed the CA/Browser Forum's TLS Baseline Requirements. In April 2025 the Forum adopted Ballot SC-081v3, which lowers the maximum lifetime of those certificates in three steps. Every CA that voted either voted yes or abstained, and Apple, Google, Microsoft and Mozilla all voted yes. The limits apply to the date a certificate is issued, so nothing you already have stops working early; each renewal simply comes sooner.
| Certificate issued | Maximum validity | Domain validation can be reused for | Renewals a year, at least |
|---|---|---|---|
| before 15 March 2026 | 398 days | 398 days | 1 |
| 15 March 2026 to 15 March 2027 | 200 days | 200 days | 2 |
| 15 March 2027 to 15 March 2029 | 100 days | 100 days | 4 |
| from 15 March 2029 | 47 days | 10 days | 8 |
"Until" dates are exclusive: a certificate issued on 15 March 2027 already falls under the 100-day limit. The rules count a day as 86,400 seconds and any extra second as another day, so CAs issue slightly less than the maximum.
What actually changes for you
With a 398-day limit, one manual renewal a year was normal. At 100 days it is four a year per certificate, and at 47 days at least eight, each one also needing fresh proof that you control the domain once the validation reuse period falls to 10 days in 2029. For a company with certificates on load balancers, CDNs, mail servers and appliances, manual renewal stops being realistic. Short-lived certificates (7 days or less) are a separate category that CAs are not required to revoke; most sites will not use them, but they show where things are going.
What to do now
- Automate issuance and renewal. Use an ACME client (Certbot, acme.sh, lego), a server that does it built in (Caddy, Traefik), cert-manager on Kubernetes, or your platform's managed certificates. Let's Encrypt is already at 90 days and is moving to 64 days in February 2027 and 45 days in February 2028.
- Renew early, not at the last minute. Let's Encrypt recommends renewing about two thirds of the way through a certificate's life and using ACME Renewal Information (ARI), which lets the CA tell your client when to renew. A hard-coded "renew every 60 days" breaks with 45-day certificates.
- Make domain validation repeatable. HTTP-01 needs port 80 reachable; DNS-01 needs API access to your DNS. Firewalls, CDN rules and DNS provider changes are common reasons a renewal that worked for years suddenly fails.
- Make sure the new certificate is served. A renewal can succeed on disk while nginx, HAProxy or a Java keystore keeps serving the old one until it is reloaded. Check the certificate the server actually sends, which is what this tool does.
- Watch expiry from outside. Automation fails silently. Put the dates in a calendar (below) or let a monitor alert you: Vigil's SSL monitor alerts when a certificate comes within 14 days of expiring, adjustable per monitor.
A free calendar feed lists each certificate's expiry date and each domain's registry expiry date, with reminders 14 and 3 days before. Your calendar app re-reads it about every 12 hours, so a renewed certificate moves to its new date by itself.
Related: how to monitor SSL certificates, the domain expiry checker (a domain can lapse while its certificate is fine) and the security headers check.
FAQ
When will SSL certificates be limited to 47 days?
Certificates issued on or after 15 March 2029 can be valid for at most 47 days, under section 6.3.2 of the CA/Browser Forum's TLS Baseline Requirements (added by Ballot SC-081v3 in April 2025). Before that the maximum is 200 days for certificates issued from 15 March 2026 and 100 days for certificates issued from 15 March 2027.
What is the maximum SSL certificate validity today?
200 days for a publicly trusted TLS certificate issued today (4 November 2026); certificates issued from 15 March 2027 can last at most 100 days. The rules count a day as 86,400 seconds and any extra second as another day, so CAs issue slightly shorter certificates than the maximum.
Do I have to replace my certificate when a new limit starts?
No. Each limit applies to the date a certificate is issued. A certificate issued before a cut stays valid until its own expiry date; the next certificate you get has to follow the new maximum.
Does this affect Let's Encrypt certificates?
Let's Encrypt certificates last 90 days, already inside the 100-day limit. Let's Encrypt has announced that its default profile moves to 64-day certificates on 10 February 2027 and 45-day certificates on 16 February 2028, and recommends renewing about two thirds of the way through a certificate's life, ideally with ACME Renewal Information (ARI).
How do I know my automatic renewal is working?
Check the certificate your server actually sends, from outside, not the file on disk: a renewal can succeed while the web server keeps serving the old certificate until it is reloaded. This page shows the served certificate's dates; the free calendar feed reminds you 14 and 3 days before expiry, and Vigil's SSL monitor alerts when a certificate comes within 14 days of expiring (adjustable).
Sources
- CA/Browser Forum, Ballot SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods (adopted April 2025; 25 CA votes yes, 0 no; Apple, Google, Microsoft and Mozilla yes)
- TLS Baseline Requirements v2.3.1 (4 October 2026), section 6.3.2: 398 / 200 / 100 / 47-day maximum validity table; section 4.2.1: domain validation reuse 398 / 200 / 100 / 10 days; section 1.6.1: Short-lived Subscriber Certificate = 7 days or less
- CA/Browser Forum: current TLS Baseline Requirements (published versions)
- Let's Encrypt, "Decreasing Certificate Lifetimes to 45 Days" (2 December 2025): 90 days today; default profile 64 days from 10 February 2027 and 45 days from 16 February 2028; renew about two thirds of the way through a certificate's life; use ARI