SSL certificates: validity is dropping to 47 days
200 days in 2026, 100 days in 2027, 47 days in 2029. The timeline, what changes for Let's Encrypt and paid certificates, and how to prepare.
Reading time: 3 min Updated on 26 October 2026
The lifetime of public SSL/TLS certificates is shrinking fast. In April 2025, the CA/Browser Forum adopted ballot SC-081: the maximum lifetime will drop in stages, down to 47 days in 2029. The first stage has already been in effect since March 15, 2026.
The timeline
| Certificates issued on or after | Maximum lifetime | Domain validation reuse |
|---|---|---|
| Before March 15, 2026 | 398 days | 398 days |
| March 15, 2026 | 200 days | 200 days |
| March 15, 2027 | 100 days | 100 days |
| March 15, 2029 | 47 days | 10 days |
Two important points:
- The rule applies to certificates issued after each date. A one-year certificate bought in February 2026 remains valid until it expires.
- Validation reuse is shrinking too. In 2029, proof of domain control will only be valid for 10 days: you'll have to redo it at almost every renewal.
Who is affected?
All public certificates, free and paid alike: DV, OV and EV, whatever the authority. Browsers (Chrome, Safari, Firefox, Edge) will reject certificates that exceed these lifetimes.
Certificates issued by a company's internal authority (private PKI) are not affected.
What about Let's Encrypt?
Let's Encrypt certificates already last 90 days, which is below the 2026 caps. But Let's Encrypt has announced its own schedule for its default profile:
- February 10, 2027: 64 days.
- February 16, 2028: 45 days.
Let's Encrypt recommends that ACME clients support ARI (ACME Renewal Information): the authority itself tells the client when to renew. For clients without ARI, the guidance is to renew at two thirds of the lifetime, rather than on a fixed date.
Why this change?
- Limit the impact of a compromised key or a certificate issued by mistake: it disappears after a few weeks instead of a year.
- Revocation works poorly in practice: browsers check revocation lists rarely, if at all. A short lifetime is more reliable.
- Force automation: an infrastructure that can renew every month can also replace all its certificates in an emergency, in case of a vulnerability or a change of authority.
What it means in practice
With a 47-day validity, a certificate renewed "by hand" will require action about eight times a year per domain. For someone managing thirty sites, that's more than 200 renewals a year. The manual approach no longer holds up.
Points to watch:
- Automate every renewal: Certbot, acme.sh, cert-manager for Kubernetes, or the ACME features of your host or CDN.
- Take inventory of certificates installed by hand: appliances, load balancers, NAS devices, old servers, third-party services where a certificate was uploaded.
- Plan for paid OV/EV certificates: ask your provider whether it offers renewal via ACME. Otherwise, you'll be placing a new order every few months.
- Monitor from the outside. The more frequent the renewals, the more chances of silent failure. A broken scheduled task, a closed port, a changed DNS record: with 47 days of validity, there's little time left to notice.
How SSL Expiration Reminder helps
- Every certificate is checked automatically, every day.
- You choose when to be notified: 30, 15, 7, 5, 3 or 1 day before expiry, by email, Slack, Telegram or webhook.
- An alert also goes out as soon as a certificate becomes invalid.
- Agencies can notify each client about their own domains only.
The free plan covers 3 domains, no credit card required. You can also start by checking a site with the SSL checker.