SSL certificate lifespans are shrinking: what changes and when

For years a publicly trusted SSL (TLS) certificate could be valid for up to 398 days, so most were renewed once a year. That has changed. Under CA/Browser Forum ballot SC-081, the maximum validity shrinks in three steps:

Certificate issued	Maximum validity
Before 15 March 2026	398 days
From 15 March 2026, before 15 March 2027	200 days
From 15 March 2027, before 15 March 2029	100 days
From 15 March 2029	47 days

The first step is already in force: any certificate issued since 15 March 2026 lasts 200 days at most. The rules also recommend staying a day under each limit (199, 99 and 46 days). The dates refer to when a certificate is issued, so a certificate issued on 14 March 2026 could still run for its full 398 days.

Before issuing a certificate, the certificate authority checks that you control the domain. Until now that check could be reused for up to 398 days. SC-081 shortens that as well:

Certificate issued	Domain validation can be reused for
Before 15 March 2026	398 days
From 15 March 2026	200 days
From 15 March 2027	100 days
From 15 March 2029	10 days

Other identity information, such as organisation details in OV and EV certificates, can be reused for 398 days from 15 March 2026, down from 825. In practice, from 2029 almost every renewal will need a fresh domain check, which only automation can do comfortably.

The CA/Browser Forum is the body where certificate authorities and browser makers agree the rules for publicly trusted certificates, published as the Baseline Requirements. Ballot SC-081v3, "Introduce Schedule of Reducing Validity and Data Reuse Periods", passed on 11 April 2025. Certificate authorities voted 25 in favour, none against and 5 abstaining, and all four browser makers voting (Apple, Google, Microsoft and Mozilla) voted in favour. The schedule is in section 6.3.2 of the current Baseline Requirements.

The broad aim of shorter lifespans is that information in a certificate is re-checked more often, and that a certificate which was issued wrongly, or whose key leaked, stops being trusted sooner. It also pushes everyone towards automated renewal, since renewing by hand every few weeks is not realistic.

Yes, every SSL certificate expires, and from now on more often. A certificate issued today lasts no more than 200 days, so expect to renew at least twice a year. From March 2027 it is at least four times a year, and from March 2029, with 47-day certificates, at least eight times a year, in practice more, because renewals happen before the expiry date.

Many certificates already renew more often than the maximum requires. Automated certificate authorities typically issue short certificates and renew them well before they run out, and hosting control panels and CDNs often do this for you. You can see exactly how long any site's certificate was issued for, and how much of it is left, with our free SSL checker.

1. List every certificate you are responsible for. Include API and mail hostnames, load balancers, CDNs, staging sites and any appliances with a web interface.
2. Automate every renewal you can. Use ACME (the protocol behind Let's Encrypt and many commercial authorities) through Certbot, your web server, your hosting panel or your CDN. Anything renewed by hand once a year needs a plan before 2027.
3. Make sure renewals are actually loaded. Reload the web server after each renewal, and push new certificates to every server and load balancer that serves the name.
4. Check that domain validation keeps working. HTTP and DNS validation can break when redirects, firewalls or DNS providers change. From 2029 validation is needed almost every time.
5. Monitor what visitors actually receive. An outside check of the live certificate catches failures whatever their cause.

PulseStack™ SSL certificate monitoring reads each site's live certificate up to once an hour and alerts you when it is within your chosen number of days of expiry, or stops being trusted. If a certificate has already lapsed, see our guide to an expired SSL certificate, and to check dates yourself, our guide on how to check an SSL certificate's expiry date.

Does an SSL certificate expire?

Yes. Every publicly trusted SSL (TLS) certificate has a fixed expiry date, its "not after" date. After it, browsers show a security warning instead of the site until a renewed certificate is installed.

How often do SSL certificates expire?

It depends on when the certificate was issued. Certificates issued from 15 March 2026 can last at most 200 days, from 15 March 2027 at most 100 days, and from 15 March 2029 at most 47 days. Certificates issued before 15 March 2026 could last up to 398 days. Many certificates, especially free ones, are issued for less than the maximum.

Who decided to shorten certificate lifespans?

The CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for publicly trusted certificates. Ballot SC-081v3 passed on 11 April 2025, with certificate authorities voting 25 in favour, none against and 5 abstaining, and Apple, Google, Microsoft and Mozilla all in favour.

Do I need to do anything if my certificates renew automatically?

Make sure the automation really works end to end: renewals run on schedule, domain validation still succeeds, and the web server reloads the new certificate. With 47-day certificates, renewals happen at least eight times a year, so a silent failure is found far sooner.

Do the changes affect internal or private certificates?

The schedule applies to publicly trusted TLS certificates issued under the CA/Browser Forum's Baseline Requirements. Certificates from your own private certificate authority, trusted only inside your organisation, follow whatever policy you set.