SSL certificate lifetimes are dropping to 47 days
The CA/Browser Forum ballot SC-081v3 cuts maximum certificate validity to 200 days in 2026, 100 in 2027 and 47 in 2029. What changes, and what you have to do about it.
In April 2025 the CA/Browser Forum approved ballot SC-081v3, which reduces the maximum lifetime of a publicly trusted TLS certificate in three steps. It is the largest change to certificate operations in a decade, and unlike most standards work it has a hard, published timetable.
The schedule
- 15 March 2026: maximum lifetime drops to 200 days.
- 15 March 2027: maximum lifetime drops to 100 days.
- 15 March 2029: maximum lifetime drops to 47 days.
The limit applies to certificates issued on or after each date. Certificates issued before a step keep the lifetime they were issued with, so the change arrives gradually rather than invalidating anything overnight.
Why it is happening
Two reasons, both about limiting damage. Revocation has never worked reliably in practice: browsers cannot always check it, and a revoked certificate can stay accepted for far longer than anyone would like. A short lifetime bounds that exposure without depending on revocation at all. The second reason is that domain validation data also ages. A certificate valid for over a year can outlive the ownership of the domain it was issued for.
What actually changes for you
Arithmetic, mostly. At 398 days a certificate was renewed roughly once a year and a calendar reminder was a workable process. At 200 days it is twice a year. At 47 days it is roughly eight times a year, per certificate. Multiply by the number of hostnames you run and manual renewal stops being a process and starts being a full-time hazard.
What to do
- Automate issuance. ACME clients such as certbot, acme.sh or the one built into your web server or platform handle renewal without human involvement. If any certificate in your estate is still issued by hand, that is the one that will expire.
- Inventory what you actually have. Most organisations discover certificates nobody remembers installing: an old admin panel, a staging host, an appliance with a self-managed certificate that no ACME client touches.
- Monitor the served certificate, not the intended one. Automation fails quietly. A renewal that succeeded at the authority but was never reloaded by the web server leaves the expired file in place, and only an external check sees that.
- Watch the intermediate chain too. Reinstalls are when incomplete chains get introduced, and an incomplete chain fails on some clients while working on yours.
The part people underestimate
Shorter lifetimes make automation mandatory, and automation makes monitoring more important, not less. Once renewal is a machine's job, nobody is watching it happen. The failure you are protecting against stops being 'somebody forgot' and becomes 'the job broke three cycles ago and nothing said so'. An independent check on the certificate your visitors actually receive is what closes that gap.