# SSL certificate validity: the 200, 100 and 47-day schedule By Rotomal team · Updated 2026-11-03 · Part of [Domain Security Check](https://rotomal.com/domain-security-check/) **Short answer:** Under CA/Browser Forum ballot SC-081, adopted on 11 April 2025, publicly trusted TLS certificates issued from 15 March 2026 can be valid for at most 200 days. From 15 March 2027 the maximum is 100 days, and from 15 March 2029 it is 47 days. Let's Encrypt moves its default certificates from 90 to 64 days on 10 February 2027 and to 45 days on 16 February 2028. From 15 March 2027, any certificate renewed by hand needs renewing at least four times a year. ## The schedule Each limit applies to certificates issued from that date. Domain validation can be reused for the period in the last column before the certificate authority has to check domain control again. | Certificates issued from | Maximum validity | Domain validation reuse | | --- | --- | --- | | Before 15 March 2026 | 398 days | 398 days | | 15 March 2026 | 200 days | 200 days | | 15 March 2027 | 100 days | 100 days | | 15 March 2029 | 47 days | 10 days | Certificate issuers voted 25 in favour, 0 against, with 5 abstentions, and all 4 certificate consumers voted in favour. For OV and EV certificates, organization identity checks can be reused for 398 days from 15 March 2026, down from 825. ## Let's Encrypt's own timeline | Date | Change | | --- | --- | | 13 May 2026 | Opt-in tlsserver profile switched to 45-day certificates, with authorization reuse of 7 hours | | 10 February 2027 | Default classic profile moves to 64-day certificates, with authorization reuse cut to 10 days | | 16 February 2028 | Classic profile moves to 45-day certificates, with authorization reuse of 7 hours | Let's Encrypt says most users who issue certificates automatically will not need to change anything, but that a fixed 60-day renewal schedule will no longer be enough. It recommends ACME Renewal Information (ARI) so the client knows when to renew, or renewing about two-thirds of the way through a certificate's lifetime. Let's Encrypt also stopped sending expiry reminder emails on 4 June 2025, as it announced in January 2025, so do not count on an email to warn you. ## What breaks first - Certificates installed by hand on a web server, load balancer or firewall, renewed from a calendar reminder. - Mail servers, VPN gateways, remote desktop gateways and admin panels that use a public certificate but sit outside your normal deployment. - Appliances and hosted services where you upload a certificate file through a web form. - Wildcard certificates copied onto several machines, where one renewal means several installs. - Automation that renews on a fixed 60-day timer, which Let's Encrypt says will no longer be sufficient once its lifetimes shorten. ## What to inventory now - Every hostname that serves a public certificate, including subdomains you have forgotten. Public certificate transparency logs record publicly trusted certificates issued for your domain, including hostnames you may have forgotten. - For each: the issuing certificate authority, the expiry date and the validity period. - How it renews: an ACME client such as certbot or win-acme, a hosting or CDN provider, or a person. - Where it is installed: which servers, load balancers and appliances need the new file. - Who owns it, and who gets the alert if renewal fails. - Your CAA DNS records, which limit which certificate authorities may issue for your domain. ## How often you will renew | Maximum validity | From | Minimum renewals a year | | --- | --- | --- | | 200 days | 15 March 2026 | 2 | | 100 days | 15 March 2027 | 4 | | 47 days | 15 March 2029 | 8 | Minimum renewals assume you renew on the last possible day, which nobody should. Automated renewal with monitoring is the realistic answer for anything beyond a handful of certificates. ## Start with a list of what you have Domain Security Check finds the certificates on your domain and the subdomains it can discover, including from certificate transparency logs, and reports each one's validity, chain and expiry, alongside your CAA records, HSTS and old protocol versions. It is a one-time $10 check for a verified owner, not ongoing monitoring: use it to build the inventory, then automate renewals and set up an expiry alert. ## FAQ ### When do 100-day SSL certificates start? Certificates issued from 15 March 2027 can be valid for at most 100 days, under CA/Browser Forum ballot SC-081. Since 15 March 2026 the maximum has been 200 days. ### Do my existing certificates stop working early? No. Each limit applies to certificates issued from its date. A certificate already issued keeps its expiry date; the shorter limit applies when you renew it. ### Does this affect Let's Encrypt certificates? Let's Encrypt certificates are already shorter than 100 days. Its default moves from 90 to 64 days on 10 February 2027 and to 45 days on 16 February 2028. Its opt-in tlsserver profile already issues 45-day certificates, a switch Let's Encrypt scheduled for 13 May 2026. On 7 October 2026 it confirmed the February 2027 change, scheduled its staging environment to switch to 64-day certificates on 14 October 2026, and said it expects the last 90-day certificate to expire on 11 May 2027. ### When does Let's Encrypt cut certificate lifetimes? On 10 February 2027 every Let's Encrypt subscriber moves to 64-day certificates by default, and the default is due to fall to 45 days in February 2028 (16 February 2028 in its December 2025 plan). Shorter 45-day and 6-day certificates can already be chosen through its tlsserver and shortlived profiles. ### What will the limit be in 2029? 47 days for certificates issued from 15 March 2029, with domain validation reuse cut to 10 days. ### How do I avoid an expired certificate? Automate renewal with an ACME client or your hosting provider, renew well before expiry (Let's Encrypt suggests about two-thirds of the way through the lifetime), and set up monitoring that alerts you if a renewal fails. ## Sources - CA/Browser Forum: Ballot SC-081v3, schedule of reducing validity and data reuse periods https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/ - DigiCert: TLS certificate lifetimes will officially reduce to 47 days (schedule table) https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days - Let's Encrypt: Decreasing certificate lifetimes to 45 days https://letsencrypt.org/2025/12/02/from-90-to-45/ - Let's Encrypt: 64-day certificates by default from 10 February 2027 (7 October 2026) https://letsencrypt.org/2026/10/07/64-day-certs/ - Let's Encrypt: Ending support for expiration notification emails https://letsencrypt.org/2025/01/22/ending-expiration-emails/ - Let's Encrypt docs: ACME profiles (current validity per profile) https://letsencrypt.org/docs/profiles/ [Domain Security Check](https://rotomal.com/domain-security-check/) does this for you. Request it free, no card: https://rotomal.com/domain-security-check/request/ --- Rotomal · https://rotomal.com/domain-security-check/ssl-certificate-validity-100-days/ · hello@rotomal.com