The certificate authorities and the browser makers have agreed to shorten the life of public TLS certificates in steps, from 398 days to 47 days by 2029. The first step took effect on 15 March 2026. Certificates will need renewing more often, and the time to get ahead of it is now.
The schedule
The CA/Browser Forum, where certificate authorities and browser makers set the rules for public certificates, adopted Ballot SC-081v3 on 11 April 2025, with no votes against. It sets two limits: how long a certificate may last, and how long a certificate authority may reuse an earlier check that you control the domain.
| Certificates issued | Longest lifetime | Domain check can be reused for |
|---|---|---|
| Before 15 March 2026 | 398 days | 398 days |
| From 15 March 2026 | 200 days | 200 days |
| From 15 March 2027 | 100 days | 100 days |
| From 15 March 2029 | 47 days | 10 days |
The rules cover publicly trusted TLS certificates, the kind on websites. Certificates from a company's own internal certificate authority aren't covered.
Where we are now
Every certificate issued since 15 March 2026 lasts 200 days at most. Certificates issued before that date could run for up to 398 days, so some of them are still in use.
What it means for manual renewals
- A certificate you renewed by hand once a year now needs renewing at least twice a year.
- From March 2027 that's about every three months.
- From March 2029 it's about every six weeks, and the domain check has to be done again for nearly every new certificate.
At that pace, renewing by hand gets hard to keep up with. Ask your hosting company or certificate provider whether they renew automatically (most use the ACME protocol, as Let's Encrypt does). Make a list of the places where automation is hard: an older server, a firewall or another appliance with a certificate uploaded by hand.
What it means for monitoring
More renewals a year means more moments when one can go wrong: a renewal job that stopped, a CDN still serving the old certificate, a DNS change that broke the domain check. Why certificates expire even with auto-renewal goes through each one.
Expiry dates also stop lining up with the calendar, so a yearly reminder no longer fits. SSL Monitor reads the expiry from the certificate each host serves, every day, whatever its lifetime. Nothing changes on your side as the lifetimes get shorter.
Sources
- CA/Browser Forum, Ballot SC-081v3: Introduce schedule of reducing validity and data reuse periods, voting closed 11 April 2025.
- DigiCert, TLS certificate lifetimes will officially reduce to 47 days (the dates in the table).