SSL Certificate Validity: 200 Days Now, 100 in 2027, 47 Days by 2029

For years a public SSL/TLS certificate could last 398 days, so renewing it was a calendar reminder once a year. That era is over. Under CA/Browser Forum Ballot SC-081v3, maximum certificate lifetimes shrink in three steps, and the first one is already in effect.

The timeline

Certificates issued before each date stay valid until they expire naturally. Some CAs moved early: DigiCert stopped issuing certificates longer than 199 days from February 24, 2026.

What Let's Encrypt is doing

Let's Encrypt certificates were always 90 days, but they are getting shorter too:

• May 13, 2026: the opt-in tlsserver profile issues 45-day certificates.
• February 10, 2027: the default classic profile moves to 64 days, and authorization reuse drops from 30 to 10 days.
• February 16, 2028: the default becomes 45 days, with a 7-hour authorization reuse period.
• A shortlived profile with 6-day certificates is available to anyone who wants it.

Two earlier changes matter for anyone still renewing by hand: Let's Encrypt stopped sending expiry reminder emails, and it dropped OCSP URLs in favor of CRLs in May 2025. Nobody will warn you anymore; the first sign of a missed renewal is a browser error.

Why manual renewal stops working

At 47 days, a manual process means renewing roughly every month, per certificate, forever. Teams that buy one-year certificates and paste them into a control panel will either automate or have outages. The goal of the change is exactly that: certificates that are replaced often limit the damage of a leaked key and force the automation that makes revocation practical.

How to automate

• Use ACME. Certbot, acme.sh, Caddy (built in), Traefik, cert-manager on Kubernetes, and most hosting panels speak ACME. Commercial CAs including DigiCert and Sectigo offer ACME endpoints too.
• Renew on schedule, not at a fixed age. Let's Encrypt recommends clients that support ACME Renewal Information (ARI), which tells them when to renew. Without ARI, renew at about two-thirds of the lifetime, not "every 60 days".
• Reload the server after renewal. A renewed file on disk does nothing until nginx, Apache or your load balancer reloads it. Add a deploy hook.
• Cover every place a certificate lives: CDN edge, load balancer, origin server, mail server, internal APIs. The origin is the one people forget.
• Monitor from the outside. Automation fails quietly (DNS changes, firewall rules, expired API tokens for DNS challenges). An external check that alerts at 30, 14 and 7 days catches it.

Check your certificate now

The website vulnerability scanner shows the issuer, days remaining and the certificate's total lifetime. A lifetime over 100 days usually means it was bought and installed by hand, so it gets flagged as a manual-renewal risk.

If you have several sites and want alerts before anything expires, the monitoring plan re-scans weekly and emails you at 30, 14 and 7 days.