SSL Certificates Are Shrinking to 47 Days. Here's the Timeline.

• Before March 15, 2026: up to 398 days
• March 15, 2026: up to 200 days (in effect now)
• March 15, 2027: up to 100 days
• March 15, 2029: up to 47 days

The same ballot shortens how long a CA can reuse domain validation, down to 10 days by 2028. In practice, that means you have to prove control of the domain almost every time you renew.

A yearly certificate used to be one calendar reminder. At 47 days, that's roughly eight renewals a year per certificate, too many to do by hand. If you still renew any certificates manually (a paid wildcard, an appliance, a load balancer, a mail server), those are the ones that will bite first.

Let's Encrypt certificates were already short-lived and automated, but Let's Encrypt stopped sending expiry reminder emails in 2025, so a broken renewal no longer warns you.

Inventory every certificate. Not just websites: mail servers, VPNs, APIs, internal tools and the origin servers behind a CDN. The cert nobody remembers is the one that expires.

Automate renewal everywhere you can. ACME (certbot, acme.sh, Caddy, your host's built-in tooling) for anything that supports it. Make sure the renewal also reloads the service.

Monitor the live certificate, not the renewal job. A job can report success while the server keeps serving the old cert. An outside check of the actual certificate catches both failures.

Watch the origin behind your CDN. Public checkers only see the edge certificate. The origin cert expiring shows up as Cloudflare Error 526.

DomainCat checks every certificate you add several times a day and emails you 30, 14 and 7 days before expiry, including the origin cert behind Cloudflare. It handles many domains at once (you can import a whole Cloudflare account with a read-only token), so shorter lifetimes don't mean more things to remember.

What is the maximum SSL certificate lifetime in 2026?
200 days. Since March 15, 2026, publicly trusted TLS certificates can be valid for at most 200 days under CA/Browser Forum ballot SC-081v3.

When do SSL certificates become 47 days?
March 15, 2029. The limit drops to 100 days on March 15, 2027, then to 47 days on March 15, 2029.

Does the 47-day limit apply to Let's Encrypt?
It applies to all publicly trusted TLS certificates. Let's Encrypt certificates are already shorter than 200 days and renewed automatically, but they still need monitoring because broken renewals no longer trigger a reminder email.

Do internal or private CA certificates have to follow this?
No. The CA/Browser Forum rules cover publicly trusted certificates. Certificates from your own private CA follow your own policy.