TLS Certificate Lifetimes Are Shrinking to 47 Days: The Schedule

If you still renew a certificate by hand once a year, that routine has already ended. Since March 15, 2026, publicly trusted TLS certificates can be valid for at most 200 days, and the limit keeps falling until it reaches 47 days in 2029. Let's Encrypt is going further with its own move to 45-day certificates. This post gives you the verified dates, explains what changes at each step, and shows how to make renewal something you never have to think about.

The official schedule

The change comes from CA/Browser Forum Ballot SC-081v3, which amended the TLS Baseline Requirements that every publicly trusted certificate authority must follow. Voting closed on April 11, 2025. Certificate issuers voted 25 in favor, none against and 5 abstaining, and all four certificate consumers (the browser vendors) voted in favor.

The Baseline Requirements now set these maximums, based on when the certificate is issued:

A separate limit applies to organization details in OV and EV certificates. Reuse of "Subject Identity Information" validation dropped from 825 days to 398 days on March 15, 2026. That doesn't affect domain-validated (DV) certificates, which most websites use.

As of October 2026, we're in the 200-day phase. The next cut, to 100 days, takes effect on March 15, 2027.

What "domain validation reuse" means

Before issuing a certificate, a CA must confirm you control the domain, usually through a DNS record, a file at a well-known URL, or an email. The CA may then reuse that confirmation for a period. By 2029, that period is only 10 days, so in practice the CA has to re-check domain control almost every time it issues. That's trivial for an ACME client that answers challenges automatically. It's painful for anyone who validates by clicking a link in an email.

Existing certificates are not cut short

The limits apply at issuance. A 398-day certificate issued in early March 2026 stays valid until it expires. The change catches you at your next renewal, when your CA can only issue a shorter certificate.

Let's Encrypt's own timeline

Let's Encrypt certificates have been 90 days for years, which is already under the 200- and 100-day limits. Let's Encrypt has announced a staged move to 45 days, delivered through ACME profiles:

Let's Encrypt also offers a shortlived profile with six-day certificates for those who want them. Changes reach the staging environment about a month before each production date, so you can test early.

Two other Let's Encrypt changes matter here:

• No more expiry emails. Let's Encrypt stopped sending expiration notification emails on June 4, 2025. If renewal fails, nobody warns you unless you set up your own monitoring.
• No more OCSP. Let's Encrypt removed OCSP URLs from its certificates in May 2025 and shut down its OCSP responders in August 2025. Revocation information is published through CRLs instead. If your Nginx config still has ssl_stapling on for Let's Encrypt certificates, you'll see warnings. Those directives can go.

Let's Encrypt also announced a new DNS-PERSIST-01 challenge in February 2026. It lets a persistent DNS record prove domain control for an ACME account, which helps setups where updating DNS on every renewal is hard. Check your ACME client and Let's Encrypt's current documentation for production availability before you depend on it.

Why the industry is doing this

The ballot was proposed by Apple and endorsed by Sectigo, Google Chrome and Mozilla. Its stated reasons come down to limiting how long stale or bad data stays trusted:

• Certificates are a snapshot. A certificate records facts as of its issuance date. The longer it lives, the more likely those facts (who controls the domain, who holds the key) have changed.
• Revocation doesn't scale. The ballot argues that CRLs and OCSP don't protect users well at internet scale. A short lifetime caps the damage from a leaked key or a misissued certificate without relying on revocation checks.
• Domain ownership changes. Domains expire, get sold, or move providers. Long validation reuse lets a certificate outlive the owner's actual control of the domain.
• Faster crypto changes. If an algorithm is weakened, the whole ecosystem can move to a new one within one short certificate lifetime.
• Better automation. The ballot treats this as a secondary benefit: short lifetimes push everyone toward automated renewal, which turns emergency replacements into routine ones.

What this means for you

If you use Let's Encrypt with Certbot or another ACME client

You're mostly ready. Check three things:

1. Renewal is scheduled. On most Linux installs Certbot ships a systemd timer or cron job. Confirm it:

systemctl list-timers | grep -i certbot
sudo certbot renew --dry-run

2. The server reloads after renewal. A renewed certificate on disk does nothing until Nginx or Apache reloads:

sudo certbot renew --deploy-hook "systemctl reload nginx"

3. Renewal timing isn't hard-coded. Scripts that assume "renew at 30 days left" will break at 45-day lifetimes. Let's Encrypt recommends ACME Renewal Information (ARI), which lets the CA tell your client when to renew. Without ARI, renew at about two-thirds of the certificate's lifetime.

If you buy certificates and install them manually

This is the group most affected. At 200 days you renew at least twice a year. From March 2027, at 100 days, it's four times a year. From 2029, it's roughly every six weeks, with domain validation repeated almost every time. Options:

• Use ACME with your commercial CA. Most major CAs now support ACME, so you can keep your vendor and automate.
• Let your host or CDN manage certificates. Managed hosting, Cloudflare, and most platforms (Netlify, Vercel, Shopify, managed WordPress hosts) issue and renew certificates automatically.
• Make an inventory of what can't be automated. Load balancers, appliances, mail servers and IoT devices with upload-only certificate screens are where outages will happen. Find them now.

If you run a CAA record

Automation often means adding a new CA. If your domain has a CAA record that only authorizes your current vendor, issuance from Let's Encrypt or another CA will fail. Our CAA records guide shows how to authorize more than one CA.

Monitoring matters more than ever

More renewals means more chances for a renewal to fail quietly. Common causes are a changed firewall rule that blocks HTTP-01 challenges, a DNS provider API token that expired, a server migrated without its cron jobs, and a CDN rule that redirects /.well-known/acme-challenge/. Monitor the certificate your site actually serves, from outside your network, on every hostname:

# Days remaining on the certificate a hostname is serving
host=example.com
end=$(echo | openssl s_client -connect $host:443 -servername $host 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
echo $(( ( $(date -d "$end" +%s) - $(date +%s) ) / 86400 )) days left

Alert when fewer than a third of the lifetime remains. Then you'll have time to fix a failed renewal before it becomes an outage, which matters even more if you use HSTS, where an expired certificate means visitors can't click through at all.

Frequently asked questions

Does this apply to my internal or self-signed certificates?

No. The Baseline Requirements cover publicly trusted TLS certificates issued by CAs in browser root programs. Private CAs and self-signed certificates aren't bound by them, although browsers and operating systems may set their own rules for privately trusted certificates.

Can I still buy a multi-year certificate?

Some vendors sell multi-year subscriptions, but each certificate issued under them is limited to the maximum at its issuance date: 200 days now, 100 days from March 15, 2027. You'll reissue and reinstall more often within the subscription.

When should I renew a Let's Encrypt certificate?

Let Certbot or your ACME client decide, ideally using ARI. Without ARI, renew at about two-thirds of the lifetime: around day 60 for a 90-day certificate, or day 30 for a 45-day one.

Will 47-day certificates affect site speed or SEO?

No. Certificate lifetime has no effect on page speed or rankings. The only SEO risk is an expired certificate, which shows visitors a warning and can stop crawlers from fetching your pages.

What to do next

List every hostname and device that presents a public certificate, mark which ones renew automatically, and fix the manual ones before March 15, 2027, when the limit drops to 100 days. Run a free audit to see the certificate each hostname serves and its expiry date. For recurring checks with email reports, see scheduled monitoring on our paid plans, and read common SSL certificate errors for what to do when a renewal does fail.

Related reading

• Automate SSL Certificate Renewal: Certbot, acme.sh and AutoSSL: How to automate SSL/TLS certificate renewal with Certbot, acme.sh or cPanel AutoSSL, test it, reload your server, and monitor expiry from outside.
• Let's Encrypt 64-Day Certificates: Test Your Renewals Before February 2027: Let's Encrypt scheduled 64-day staging certificates from October 14, 2026, before they become the default on February 10, 2027. How to check your renewals.

Sources

• CA/Browser Forum: Ballot SC-081v3, reducing validity and data reuse periods
• CA/Browser Forum: TLS Baseline Requirements
• Let's Encrypt: Decreasing certificate lifetimes to 45 days
• Let's Encrypt: Ending Support for Expiration Notification Emails
• Let's Encrypt: Ending OCSP Support in 2025