200-Day TLS Certificates: The First Renewal Wave Is Here

Since 15 March 2026, publicly trusted TLS certificates can be valid for no more than 200 days, under rules agreed by the CA/Browser Forum in Ballot SC-081v3. Certificates issued on that date reached the end of their 200-day life on 1 October 2026, so the first wave of short-lived certificates is now coming up for renewal across UK websites. The next cut, to 100 days, applies to certificates issued from 15 March 2027, which gives site owners about five months to make renewal fully automatic.

Key takeaways

Publicly trusted TLS certificates issued since 15 March 2026 can be valid for no more than 200 days, and the first ones expired on 1 October 2026.
Certificates issued from 15 March 2027 are capped at 100 days, falling to 47 days for those issued from 15 March 2029.
Automate issuance and renewal with ACME, using ACME Renewal Information or renewing about two-thirds of the way through a certificate's lifetime.
Check your DNSSEC and CAA records, because a DNSSEC validation error can now block a certificate renewal.

What happened

The CA/Browser Forum is the industry body of certificate authorities and browser makers that sets the Baseline Requirements every public certificate must follow. Ballot SC-081v3 closed on 11 April 2025. Certificate issuers voted 25 in favour, none against, with 5 abstaining, and all four certificate consumers (Apple, Google, Microsoft and Mozilla) voted yes.

The current Baseline Requirements set this schedule, based on the date a certificate is issued:

Certificate issued	Maximum validity	Domain validation reuse
Before 15 March 2026	398 days	398 days
15 March 2026 to 14 March 2027	200 days	200 days
15 March 2027 to 14 March 2029	100 days	100 days
From 15 March 2029	47 days	10 days

Some authorities moved early. DigiCert says it applied a 199-day maximum from 24 February 2026, three weeks before the deadline. By our calculation, those certificates began expiring around 11 September 2026.

Certificates issued before 15 March 2026 keep their original validity. A 398-day certificate bought in early March 2026 runs until April 2027, which means some organisations will skip the 200-day phase entirely and meet the 100-day rule at their next renewal.

Other changes that arrived with the 200-day cap

The same Baseline Requirements update brought several less publicised changes on 15 March 2026:

DNSSEC validation by CAs. Certificate authorities must now validate DNSSEC on the DNS lookups they make for domain validation and CAA checks, and a DNSSEC validation error is not treated as permission to issue. A broken DNSSEC setup can therefore block a certificate renewal.
Shorter reuse of domain validation. Proof that you control a domain can now be reused for only 200 days, falling to 100 days in March 2027 and 10 days in March 2029.

Further changes are already scheduled:

15 March 2027: CAs must process the accounturi and validationmethods CAA parameters (RFC 8657), letting you lock issuance to a specific ACME account or method.
15 March 2028: Email-based domain validation methods (email to a constructed address such as admin@, and email to DNS CAA or TXT contacts) can no longer be used.
DigiCert's trust calendar also lists Chrome's removal of the client authentication extended key usage from public TLS certificates from 15 March 2027, which matters if you use public certificates for machine-to-machine authentication.

Let's Encrypt, which issues a large share of the web's certificates, already uses 90-day certificates. On 2 December 2025 it announced it would move further: an opt-in 45-day profile from 13 May 2026, 64-day certificates by default from 10 February 2027, and 45-day certificates by default from 16 February 2028.

What this means for small businesses

For a small business on a modern host that renews Let's Encrypt certificates automatically, very little changes. The risk sits with organisations that still buy a certificate, download it and install it by hand once a year: high-street retailers with a legacy e-commerce server, councils and charities with appliances, or agencies managing dozens of client sites.

Under a 200-day cap, a manual process means at least two renewals a year per certificate. At 100 days it means four, and at 47 days roughly eight. Each missed renewal produces a full-page browser warning that stops visitors, breaks checkout and can disrupt APIs and email servers that rely on the same certificate. For agencies, the workload grows with every client.

The DNSSEC and CAA changes are a second, quieter risk. If your DNS is misconfigured, renewals can fail even when automation is in place.

What to do now

Find every certificate you own. Include your main site, subdomains, mail servers, load balancers, VPN gateways and any third-party platforms on your domains. Use the MakeItFlow SSL checker to see the issuer and expiry date of each.
Automate issuance and renewal with ACME. Most hosts, CDNs and commercial CAs now support ACME clients such as Certbot. Avoid fixed "renew every 60 days" scripts; Let's Encrypt recommends ACME Renewal Information (ARI), or renewing about two-thirds of the way through a certificate's lifetime.
Remove manual installation steps. If a certificate must be copied to an appliance or a separate server, script that step too. A certificate that renews but is not deployed still expires.
Check DNSSEC and CAA. Run a DNS lookup and confirm DNSSEC validates and your CAA records list the authorities you actually use. Our guides to DNSSEC and CAA records explain both.
Set up expiry monitoring. A free website audit on MakeItFlow reports your TLS certificate, DNSSEC and CAA alongside security headers. Paid plans add scheduled re-scans, so a certificate that failed to renew shows up before visitors see a warning.
Plan for 15 March 2027. Budget time now to finish automation for any certificate that still needs a person to renew it.

For the full background, read our explainer on TLS certificate lifetime changes and our guide to common SSL certificate errors.

Frequently asked questions

Does the 200-day limit make my current certificate invalid?

No. The rule applies to certificates issued on or after 15 March 2026. A certificate issued before that date stays valid until its original expiry date, up to 398 days.

Do I have to pay for more certificates?

Not necessarily. Many commercial CAs sell multi-year subscriptions that cover repeated reissues within the term, and Let's Encrypt certificates are free. What increases is the number of renewals, so the cost that rises is manual labour, not usually the certificate itself.

Does this affect internal or private certificates?

The Baseline Requirements cover publicly trusted certificates used on the web. Certificates from a private, internal CA follow your own policy, although the same automation habits are worth adopting.

Automate SSL Certificate Renewal: Certbot, acme.sh and AutoSSL: How to automate SSL/TLS certificate renewal with Certbot, acme.sh or cPanel AutoSSL, test it, reload your server, and monitor expiry from outside.