SSL Renewal Check

7 dates still ahead

Certificate lifetime timeline

Every rule that shortens public HTTPS certificates, from the CA/Browser Forum and from Let’s Encrypt, with countdowns that update on each date.

Timezone rule: A dated rule applies to certificates issued on or after 00:00 UTC on that date. Pages are rebuilt daily at 10:15 UTC, and countdowns also update in the visitor's browser using the UTC date.

Industry limits (every public certificate authority)

Set by CA/Browser Forum Ballot SC-081v3 and written into the Baseline Requirements. Where a CA has published its own earlier date, it appears under the official one.

  1. In effect since March 15, 2026 All public CAs
    Maximum certificate lifetime drops to 200 days (200 days; validation reuse 200 days)[CA/Browser Forum 1, 2]

    Publicly trusted TLS certificates issued on or after this date may be valid for at most 200 days. Domain validation can be reused for at most 200 days.

    ↳ DigiCert caps certificates at 199 days: February 24, 2026[DigiCert 1, 2]

    ↳ SSL.com starts issuing 200-day certificates: March 11, 2026[SSL.com]

    ↳ Sectigo caps certificates at 199 days: March 12, 2026[Sectigo 1, 2]

  2. In 120 days All public CAs
    Maximum certificate lifetime drops to 100 days (100 days; validation reuse 100 days)[CA/Browser Forum 1, 2]

    Certificates issued on or after this date may be valid for at most 100 days. Domain validation can be reused for at most 100 days.

    ↳ DigiCert plans a 99-day maximum: “early 2027”[DigiCert]

  3. In 851 days All public CAs
    Maximum certificate lifetime drops to 47 days (47 days; validation reuse 10 days)[CA/Browser Forum 1, 2]

    Certificates issued on or after this date may be valid for at most 47 days. Domain validation can be reused for at most 10 days.

    ↳ DigiCert plans a 46-day maximum: “early 2029”[DigiCert]

Let’s Encrypt

Let’s Encrypt shortens its own certificates earlier than the industry deadlines. Each change applies at your next renewal after the date.

  1. In effect since June 4, 2025 Let’s Encrypt
    Let's Encrypt stops sending expiry-reminder emails[Let's Encrypt 1, 2]

    Let's Encrypt ended its expiration notification emails. It recommends a third-party monitoring service instead.

  2. In effect since May 13, 2026 Let’s Encrypt Opt-in only
    Let's Encrypt opt-in "tlsserver" profile issues 45-day certificates (45 days; validation reuse 7 hours)[Let's Encrypt 1, 2]

    Early adopters who select the tlsserver profile in their ACME client get 45-day certificates with a 7-hour authorization reuse period.

  3. In effect since October 14, 2026 Let’s Encrypt
    Let's Encrypt staging environment switches to 64-day certificates[Let's Encrypt]

    Testing environment only. Lets you test your renewal setup before the production change.

  4. In 87 days Let’s Encrypt
    Let's Encrypt default certificates drop to 64 days (64 days; validation reuse 10 days)[Let's Encrypt 1, 2]

    The default classic profile issues 64-day certificates with a 10-day authorization reuse period. You get the shorter lifetime at your next renewal after this date.

  5. In 177 days Let’s Encrypt
    Last 90-day Let's Encrypt certificate expected to expire[Let's Encrypt]

    Let's Encrypt expects the last 90-day certificate to expire around this date. It will not revoke valid certificates as part of the change.

  6. In 458 days Let’s Encrypt
    Let's Encrypt default certificates drop to 45 days (45 days; validation reuse 7 hours)[Let's Encrypt 1, 2]

    The classic profile issues 45-day certificates with a 7-hour authorization reuse period.

Domain validation methods

How you prove you control a domain is changing too. This matters most if you buy certificates and approve them by email or phone. See the email validation guide.

  1. In effect since March 15, 2026 All public CAs Domain validation
    Email domain validation becomes "should not be used"[CA/Browser Forum]

    Validation by email to admin@, administrator@, webmaster@, hostmaster@ or postmaster@ your domain, or to the DNS CAA/TXT email contact, SHOULD NOT be used to issue certificates from this date.

  2. In 120 days All public CAs Domain validation
    Phone-based domain validation ends[CA/Browser Forum]

    CAs must not rely on phone contact via the DNS TXT or DNS CAA phone contact (methods 3.2.2.4.16 and 3.2.2.4.17) to issue certificates.

  3. In 486 days All public CAs Domain validation
    Email domain validation (admin@, webmaster@ …) ends[CA/Browser Forum]

    CAs must not rely on email to admin@, administrator@, webmaster@, hostmaster@ or postmaster@ the domain, or to the DNS CAA/TXT email contact. Earlier validations made this way can no longer be reused.

Certificate authorities leaving the market

  1. In effect since October 16, 2025 Buypass
    Buypass stops selling TLS certificates[Buypass]

    Buypass TLS/SSL certificates can no longer be ordered, renewed or replaced. Existing certificates stay valid until they expire.

Questions

When does the 100-day certificate limit start?

Certificates issued on or after March 15, 2027 can be valid for at most 100 days, under the CA/Browser Forum Baseline Requirements.

When do certificates become 47 days?

From March 15, 2029: certificates issued on or after that date may last at most 47 days, and domain validation can be reused for only 10 days.

Do these dates affect my current certificate?

No. Each limit applies to certificates issued on or after the date. Your current certificate stays valid until it expires; the next one you get is the one that is shorter.

Why does my certificate authority use a different date?

Some certificate authorities switched a few days or weeks before the industry deadline (DigiCert on February 24, 2026, SSL.com on March 11, 2026 and Sectigo on March 12, 2026). We show a CA’s own date only when it has published one.

When does Let’s Encrypt switch to 64-day certificates?

On February 10, 2027 for its default profile, then 45-day certificates from February 16, 2028.

Sources

Facts on this page last checked November 15, 2026.