SSL Certificate Validity Is Shrinking: 200 Days Now, 100 in 2027, 47 by 2029
Public SSL certificates now last 200 days at most, and Let's Encrypt moves to 64 days on February 10, 2027. See the full timeline to 47 days in 2029, why it's happening and how to get your renewals ready.
SSL certificates used to be something you set up once a year and forgot about. Not anymore.
Since March 15, 2026, a public SSL certificate can last 200 days at most. In March 2027 that drops to 100 days, and by March 2029 it will be just 47 days. Let's Encrypt is moving even sooner: from February 10, 2027, its certificates will last 64 days instead of 90.
Here's what that means for your website, in plain terms, and the easiest way to stay ahead of it.
The SSL certificate validity timeline
The browser makers and certificate authorities agreed on these limits in 2025 (CA/Browser Forum ballot SC-081). Every public certificate authority has to follow them:
- Until March 15, 2026: up to 398 days
- Now (since March 15, 2026): up to 200 days
- From March 15, 2027: up to 100 days
- From March 15, 2029: up to 47 days
Let's Encrypt has its own, faster plan. Its certificates go from 90 days to 64 days on February 10, 2027, and to 45 days in 2028 (Let's Encrypt announcement).
Your current certificate is safe. It keeps the expiry date it was issued with. The new limits apply the next time you renew or buy one.
Why are certificates getting shorter?
A certificate is basically an ID card for your website. The longer an ID card is valid, the longer a stolen or outdated one can be misused. Shorter lifetimes mean:
- A leaked key stops working sooner.
- If a domain changes owner, old certificates age out quickly.
- Mistakes by certificate authorities fix themselves in weeks, not a year.
Good for security. Less good for anyone renewing certificates by hand.
What this means for you
By 2029, every certificate you own will need renewing about 8 to 12 times a year. Have 10 certificates across your website, shop, API and email? That's around 100 renewals a year.
Miss just one and your visitors see a full-page "Your connection is not private" warning instead of your site. Most of them leave and don't come back.
The usual ways teams get caught out:
- A calendar reminder that worked once a year but won't work every six weeks.
- One certificate in a forgotten place, like a load balancer or an old subdomain.
- A renewal script that fails quietly, so nobody knows until the site breaks.
How to get ready in 3 steps
- Find all your certificates. Make a list of every domain and subdomain that uses HTTPS. You can't renew what you don't know about.
- Stop renewing by hand. Use a tool that renews certificates for you through ACME, the standard behind Let's Encrypt and most certificate authorities.
- Know when something goes wrong. Make sure someone is alerted when a renewal fails, while there's still time to fix it.
How CertPing makes this easy
You don't need to become a certificate expert to keep your site secure. That's the job CertPing does for you:
- Free SSL certificates. Let's Encrypt certificates are free on every plan, and renewing them from your dashboard is free too.
- All your certificates in one place. See every certificate you hold in one dashboard, instead of hunting across servers and hosting accounts.
- Paid certificates when you need them. Sectigo PositiveSSL, Multi-Domain and Wildcard certificates are available on every plan, paid per order with no subscription. See pricing.
- Domains and DNS in the same account. Register or transfer your domain with DNS included, so your domain and its certificates live side by side.
- Start for free. The Essentials plan has no monthly fee and doesn't need a card.
Running hundreds of certificates across your own servers? CertPing Enterprise adds discovery, inventory, renewal and deployment for platform teams.
Get your free SSL certificate with CertPing →
Frequently asked questions
What is the maximum SSL certificate validity right now?
200 days. Since March 15, 2026, no public SSL certificate can be issued for longer.
When will SSL certificates be reduced to 47 days?
On March 15, 2029. The limit drops to 100 days on March 15, 2027 first.
Do I need to replace my SSL certificate now?
No. Your current certificate stays valid until it expires. The new rules apply at your next renewal.
Can I still buy a multi-year SSL certificate?
Some providers sell multi-year plans, but each certificate inside the plan can't last longer than the current limit. You'll still need to renew and install it several times.
