SSL certificate lifetimes drop to 200, 100, then 47 days: a renewal calendar for agencies

The exact dates set by the CA/Browser Forum, what they mean for paid certificates, and how often each client site will need a new certificate.

For an agency, the change is not the number of days. It is the number of times someone has to do something. A client who buys a "one-year" certificate still pays once a year, but the certificate on the server has to be replaced two times or more within that year. Every manual step (generating a request, validating the domain, uploading to a hosting panel, a CDN or a load balancer) is now repeated on that rhythm. This guide gives the dates, then a calendar you can apply to each client.

The official schedule

The rules come from the CA/Browser Forum's Baseline Requirements, the document every publicly trusted certificate authority must follow. Ballot SC-081v3 was voted between 4 and 11 April 2025: 25 certificate issuers voted yes, none voted no and five abstained; Apple, Google, Microsoft and Mozilla all voted yes. Section 6.3.2 of the Baseline Requirements now reads:

Source: CA/Browser Forum, Baseline Requirements, sections 6.3.2 and 4.2.1.

Three details matter when you plan:

• The date that counts is the issue date. A certificate issued on 14 March 2027 can still last up to 200 days. One issued the next day is limited to 100. Nothing is revoked on the switch dates.
• The validity period counts both ends. The Baseline Requirements define it as running from notBefore through notAfter, inclusive, and measure a day as 86,400 seconds. That is why most authorities stay a day under the cap: DigiCert, for example, has issued certificates of at most 199 days since 24 February 2026, three weeks before the deadline.
• Organisation details last longer than domain checks. For OV and EV certificates, the identity information about the company can be reused for 398 days from 15 March 2026. Domain control, on the other hand, will have to be proven again at least every 10 days from 2029.

These rules cover publicly trusted certificates for websites. Certificates from a private, internal authority are outside the Baseline Requirements.

What it means for each type of certificate

Paid certificates (DV, OV, EV)

This is where agencies feel it first. The certificates issued around 15 March 2026 were the first 200-day ones, and Sectigo pointed out in its blog that they reached the end of their validity in early October 2026. Many teams still had a yearly reminder in their calendar for those sites.

Commercial authorities still sell plans for one year or more. DigiCert's documentation describes how it works: the plan covers the period you paid for, but each certificate issued under it lasts at most 199 days, and you reissue it at no extra cost when it approaches expiry. DigiCert adds the point that causes outages: reissuing does not replace the certificate on your server. Someone still has to install it.

Let's Encrypt and other ACME certificates

Let's Encrypt certificates last 90 days, well below every cap. Let's Encrypt has announced its own reduction: 64 days from 10 February 2027 and 45 days from 16 February 2028. Our guide on Let's Encrypt 64-day certificates covers that schedule and the renewal settings that break. For sites already on automated ACME renewal, the CA/B Forum caps change nothing.

Certificates installed by a host or a CDN

When a host or a CDN issues and renews the certificate for you, the schedule is theirs to handle. What remains on your side is checking that the certificate visitors receive is still valid, especially after a DNS or hosting change.

A renewal calendar for agencies

How often a certificate needs replacing depends on its lifetime and on the margin you keep before expiry. Sectigo recommends renewing 200-day certificates about every 180 days. For automated renewals, Let's Encrypt recommends renewing at about two thirds of the lifetime. The table below uses those two references; adjust the margin to your own process.

Some reference dates for a certificate issued at the maximum lifetime:

A certificate renewed just before a switch date keeps the longer lifetime, which can give you a few extra months to finish automating. It only postpones the work.

What to do now, client by client

1. 1List every certificate you do not renew automatically. Paid certificates, certificates uploaded by hand to a panel, a CDN, a load balancer or a mail server. These are the ones the schedule affects.
2. 2Replace yearly reminders. Any reminder based on "renew once a year" is already wrong for certificates issued since March 2026. Base reminders on the real notAfter date of each certificate, read from the live site.
3. 3Check what the client's plan includes. For multi-year or annual plans, note who reissues, who installs, and how domain validation is done. From 2029, domain validation will have to be redone at least every 10 days, so a manual email or DNS validation each time will not hold.
4. 4Move to ACME where you can. Commercial authorities offer it too: DigiCert documents ACME issuance and renewal in CertCentral, and Sectigo in Sectigo Certificate Manager. An ACME client renews and installs without anyone logging in, which is the only realistic way to handle a 47-day lifetime on dozens of sites.
5. 5Automate the copies. If a certificate is issued on one machine and copied elsewhere, script the copy and the reload. The renewal itself is rarely what fails; the step after it is. Our guide on why Let's Encrypt renewals fail lists the usual causes.
6. 6Keep the domain under watch too. A certificate cannot be renewed for a domain that has lapsed: see what happens when a domain expires.

To check the dates of the certificate a site actually serves:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -dates

How to monitor it

With lifetimes this short, the yearly reminder disappears and the risk moves to the steps nobody watches: the reissue that was never installed, the copy on the CDN that kept the old certificate, the one site renewed by hand. The useful signal is the expiry date of the certificate each site serves, read from outside, with alerts close enough to expiry to match the new lifetimes and sent to someone who still works on the project.

Lapsentry does this for agencies: it connects to each website, reads the certificate it actually serves, and tracks its expiry and issuer next to the domain's own expiry date. Alerts go out by email, Slack, Teams or SMS before either one lapses.

Start your 14-day free trial: no card required.

Sources

• CA/Browser Forum, Ballot SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods, vote of 4 to 11 April 2025.
• CA/Browser Forum, Baseline Requirements, sections 4.2.1, 6.3.2 and the definition of Validity Period (version 2.3.1).
• DigiCert, Moving to 199-day validity for public TLS certificates and Understand Multi-year Plans.
• Sectigo, 200-day certificates are starting to expire and Shorter TLS series.
• DigiCert, Automate certificate issuance using ACME; Sectigo, Automation datasheet.
• Let's Encrypt, 64-Day Certificate Lifetimes Coming Feb 2027, 7 October 2026, and Decreasing Certificate Lifetimes to 45 Days, 2 December 2025.

FAQ

What is the maximum lifetime of an SSL certificate today?

200 days for a publicly trusted certificate issued between 15 March 2026 and 14 March 2027. Most authorities issue a little less, often 199 days, to stay under the cap.

When do SSL certificates go to 47 days?

For certificates issued on or after 15 March 2029. Before that, the cap is 100 days for certificates issued from 15 March 2027, and 200 days for those issued from 15 March 2026.

Are my existing certificates affected?

No. The limits apply to the issue date. A certificate issued before a switch date stays valid until its own expiry date; the shorter lifetime applies to its replacement.

Can I still buy a multi-year SSL certificate?

You can still buy a plan that covers one or several years. The certificate itself is limited to the maximum lifetime and must be reissued and installed again during the plan, at least twice a year today.

Does the 47-day rule apply to Let's Encrypt?

Let's Encrypt is already below the caps, with 90-day certificates. It has announced its own steps: 64 days from 10 February 2027 and 45 days from 16 February 2028.

Does it apply to internal certificates?

No. The Baseline Requirements cover publicly trusted certificates for servers on the internet. Certificates issued by a private, internal authority follow that authority's own rules.

What changes for domain validation?

The period during which a domain check can be reused shrinks with the lifetimes: 200 days from March 2026, 100 days from March 2027 and 10 days from March 2029. In 2029, domain control will in practice be proven again at almost every renewal.

More guides

• Let's Encrypt moves to 64-day certificates: what agencies need to check
• Why Let's Encrypt renewals fail
• What happens when a domain expires?
• Orphaned subdomains: what they are and how to find them