SSL certificate lifetimes have started to shrink: the CA/Browser Forum’s Baseline Requirements cap public certificates at 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029 (read October 6, 2026). This guide covers the domain validation rule that shrinks with them, Let’s Encrypt’s own schedule and what a small business should check.
Last reviewed: October 6, 2026. Dates come from pages we opened on that day, and vendor pages are labeled. This is general information.
Key takeaways
- The Baseline Requirements table sets maximum certificate validity at 200 days, then 100 days, then 47 days on March 15 of 2026, 2027 and 2029.
- The reuse period for a completed domain check falls from 200 days to 100 days to 10 days on the same dates.
- Let’s Encrypt plans 64-day certificates on February 10, 2027 and 45-day certificates on February 16, 2028.
- Shorter SSL certificate lifetimes mean about 7.8 renewals a year at 47 days, our own arithmetic, against 1.8 at 200 days.
- W3Techs shows Let’s Encrypt on 64.3% of websites in October 2026, so its schedule reaches most sites.
How SSL certificate lifetimes step down in the Baseline Requirements
We read the CA/Browser Forum’s TLS Baseline Requirements on the Forum’s GitHub repository. Its compliance dates table gives three steps for subscriber certificates: 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15.
The change came from ballot SC-081v3. A vendor blog from AppViewX reports that it passed on April 11, 2025 with 29 yes votes, 25 from certificate issuers and 4 from browser makers, no votes against and 5 abstentions, and that Apple proposed it. We could not open the Forum’s own ballot page at the address we tried, so treat those counts as vendor-reported.
Domain validation reuse shrinks faster
A certificate authority checks that you control a domain before issuing. The Baseline Requirements limit how long it may reuse that check. The table we read shows 200 days from March 15, 2026, 100 days from March 15, 2027 and 10 days from March 15, 2029.
By 2029 a CA could rely on an old check for ten days at most, so almost every renewal repeats it. A site that needs someone to approve an email or edit a DNS record by hand each time will feel this sooner than the lifetime figure suggests.
Let’s Encrypt moves on its own timetable
Let’s Encrypt’s December 2, 2025 announcement says its opt-in tlsserver profile moved to 45-day certificates on May 13, 2026. Its default classic profile moves to 64 days on February 10, 2027 and to 45 days on February 16, 2028. It also cuts authorization reuse from 30 days to 10 days in 2027 and 7 hours in 2028.
Let’s Encrypt also offers six-day certificates. Its January 2025 post says they omit OCSP and CRL addresses and practically require automation, and a later update says they are generally available. At six days that is about 61 renewals a year, our own arithmetic.
Let’s Encrypt’s 10-year post says it passed 10 million certificates a day in late 2025 and protects nearly one billion web properties. In October 2026 W3Techs reported that 90.2% of sites use HTTPS by default and that Let’s Encrypt serves 64.3% of websites. W3Techs counts websites where it detects a certificate, so its definition differs from Let’s Encrypt’s own counts. We could not read figures from the Let’s Encrypt statistics page, which draws charts without text values.
What this means for a small business
Most owners will not handle certificates directly, because a host or provider does. The risk is a provider that still renews by hand as SSL certificate lifetimes fall.
| Situation | What to check |
|---|---|
| Your host manages the certificate | Ask whether renewal is automatic and how the plan handles SSL certificate lifetimes of 47 days |
| You install certificates by hand | Plan to automate with ACME or move to a managed service before 2027 |
| Certificates sit on a router, camera or printer | Check whether the device supports automated renewal, or place a proxy in front of it |
| Public certificates secure email or VPN gateways | List each gateway and its expiry date, since these are easy to forget |
The ballot’s GitHub discussion records the concern that devices such as printers and firewalls often lack automated renewal. We found no source measuring how many devices that affects.
Three steps to prepare for shorter certificates
1. List every certificate and its expiry date
Include the website, mail server, VPN and any device with a web interface. A certificate nobody remembers is the one that expires.
2. Automate renewal and validation
Use ACME where your software supports it, or a provider that handles issuing and installing. Our SSL certificates include automatic installation and renewal.
3. Plan for shorter SSL certificate lifetimes with alerts
Automation can fail quietly, so set an alert for any certificate within 14 days of expiry, and test a renewal before the 100-day step in March 2027.
Frequently asked questions about SSL certificate lifetimes
What are the new SSL certificate lifetimes?
Under CA/Browser Forum rules, the maximum validity of a public TLS certificate is 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, according to the Baseline Requirements table we read on October 6, 2026. Let’s Encrypt plans its own schedule of 64 days in February 2027 and 45 days in February 2028.
Do existing certificates stop working on March 15?
The limits apply to certificates issued on or after each date, as we read the table. We found no statement that earlier certificates are cut short.
Why does domain validation reuse matter?
A certificate authority must check that you control a domain before issuing. The reuse period is how long it may rely on that check. It falls from 200 days to 100 days in 2027 and 10 days in 2029, so a CA will repeat the check far more often.
Can I still buy a one-year certificate?
Not for public TLS certificates issued after March 15, 2026. A provider may sell a one-year plan, but it delivers shorter certificates that renew automatically.
What happens if renewal fails?
Browsers show a full-page warning for an expired certificate, and many visitors leave. Set up alerts as well as automation.
Sources
- CA/Browser Forum, TLS Baseline Requirements, sections 1.2.2, 4.2.1 and 6.3.2 (GitHub, read October 6, 2026)
- AppViewX, CA/B Forum votes yes to 47-day TLS certificates (vendor blog, read October 6, 2026)
- Let’s Encrypt, From 90 to 45 (December 2, 2025, read October 6, 2026)
- Let’s Encrypt, 6-day and IP address certificates (read October 6, 2026)
- Let’s Encrypt, 10 years of Let’s Encrypt (read October 6, 2026)
- W3Techs, SSL certificate authority usage (October 2026, read October 6, 2026)
- W3Techs, HTTPS usage (October 2026, read October 6, 2026)
- CA/Browser Forum servercert repository, SC-081 discussion (read October 6, 2026)