Originally published at https://monstermegs.com/blog/ssl-certificate-lifetimes/
How long is your SSL certificate valid? If you set it once and forget it, that habit is about to break. In 2026, SSL certificate lifetimes are being cut dramatically, and the change touches every website that serves traffic over HTTPS – which is to say, almost all of them. The CA/Browser Forum, the body that writes the rules for public certificates, has locked in a schedule that shrinks the maximum validity of a certificate from just over a year down to 47 days by 2029.
This is not a distant proposal. The first cut has already landed. Since March 15, 2026, no publicly trusted certificate can be issued with a lifetime longer than 200 days, according to DigiCert. Two more reductions follow. The era of the long-lived certificate is ending, and the way you manage SSL certificate lifetimes has to change with it.
The Rules Behind Shorter SSL Certificate Lifetimes
The decision traces back to April 2025, when the CA/Browser Forum approved Ballot SC-081v3. The proposal came from Apple and passed with broad backing from browser makers and certificate authorities. It amended the TLS Baseline Requirements – the shared rulebook every public certificate authority must follow – to set a firm schedule for shortening both certificate validity and the reuse of domain validation data. That vote makes the reductions mandatory rather than optional. Shorter SSL certificate lifetimes are now written into the standard, not left to individual providers.
The reasoning is straightforward. A certificate that stays valid for a year or more can outlive the security assumptions it was issued under. Keys get compromised. Domains change hands. Cryptographic algorithms fall out of favor. A long window gives attackers more room to abuse a stolen or mis-issued certificate. Shorter SSL certificate lifetimes narrow that window and force weak configurations out of circulation faster.
A Phased Timeline From 200 Days to 47
The rollout is deliberately gradual so operators can adapt. The maximum certificate lifetime steps down in three stages over the next three years, and each stage compounds the operational load of the one before it.
The three checkpoints
As of March 15, 2026, the ceiling is 200 days. On March 15, 2027, it drops to 100 days. On March 15, 2029, it reaches the headline figure of 47 days. In parallel, the period during which a certificate authority may reuse domain validation information shrinks to 10 days by 2029, meaning you will re-prove control of your domain far more often than you do today.
To put the change in perspective, certificates were routinely issued for two years until 2020, then capped at 398 days. The jump from 398 days to 200 is already the steepest single reduction the ecosystem has seen, and it is only the first of three. Planning around these SSL certificate lifetimes now saves a far larger headache later.
The math is unforgiving. A 200-day certificate already forces at least two renewals a year. A 47-day certificate demands roughly eight renewals annually, and that is before you factor in the tighter validation windows. These SSL certificate lifetimes leave almost no room for manual tracking or a spreadsheet full of expiry dates.
Let's Encrypt Retires Client Authentication in July 2026
The broader shift is already producing hard deadlines. On July 8, 2026, Let's Encrypt stopped issuing certificates with the TLS Client Authentication capability and retired its tlsclient ACME profile. As the certificate authority explained, “this change is prompted by changes to Google Chrome's root program requirements, which impose a June 2026 deadline to split TLS Client and Server Authentication into separate PKIs.” You can read the full notice on the Let's Encrypt blog.
For most site owners this is invisible. Standard HTTPS certificates for websites are server authentication certificates and are unaffected. But teams that used Let's Encrypt for mutual TLS, API clients, or VPN authentication now need a different source. We broke down the practical fallout in our earlier piece on client authentication changes, and it pairs directly with the shrinking SSL certificate lifetimes story.
Microsoft Blocks Legacy TLS in Exchange Online
July 2026 brought a second deadline from a different corner of the industry. Microsoft began deprecating legacy TLS in Exchange Online, blocking POP and IMAP email clients that still negotiate TLS 1.0 or TLS 1.1. Both protocols have been considered insecure for years, and Microsoft now requires TLS 1.2 or later for those connections. Anyone running an outdated email client may find that mail simply stops syncing until the software is updated.
Taken together, these moves send one message. The industry is done waiting for stragglers to modernize. Whether the target is old protocol versions or long SSL certificate lifetimes, tolerance for outdated, long-lived, or weak configurations is disappearing quickly.
Why Shorter SSL Certificate Lifetimes Matter
For a site left on autopilot, the risk is concrete. If a certificate quietly expires because no one renewed it, visitors hit a full-page browser warning that declares the site unsafe. Conversions stop. Search crawlers back off. With SSL certificate lifetimes falling to 200 days now and heading lower, the odds of an unattended site lapsing rise sharply with every cut.
The stakes for online stores
E-commerce sites feel this most acutely. A lapsed certificate on a checkout page does not just look bad; browsers actively block the connection, and shoppers abandon the cart in seconds. Payment processors and trust badges also expect a valid certificate at all times. As SSL certificate lifetimes compress, an online store that renews by hand is effectively betting its revenue on someone remembering a date.
The flip side is a genuine security win. Shorter SSL certificate lifetimes mean compromised keys and outdated certificates cycle out of the ecosystem faster, so any single failure is time-boxed. Certificate revocation has long been slow and unreliable in practice; short lifetimes achieve much of the same protection automatically by simply letting bad certificates expire on their own.
Automation Becomes the New Baseline
The clearest lesson from these SSL certificate lifetimes is that manual renewal no longer scales. The ACME protocol, the same automation standard that powers Let's Encrypt, lets a server request, install, and renew certificates with no human involvement. At roughly eight renewals a year, automation is not a nice-to-have – it is the only realistic way to keep a certificate valid without a lapse.
Good hosting makes this painless. Platforms that issue and auto-renew free SSL certificates in the background turn the whole 47-day question into a non-event. If your host handles renewal for you, the shrinking SSL certificate lifetimes barely register. This is exactly the kind of automation MonsterMegs bakes into every hosting plan.
How Certificate Authorities Are Adapting
The certificate authorities are not sitting still. Major issuers including DigiCert, Sectigo, and Google Trust Services have spent 2026 pushing customers toward ACME-based automation and certificate lifecycle management tools, publishing migration guides ahead of each deadline. Their message is consistent: treat shorter SSL certificate lifetimes as a prompt to automate now, while the ceiling is still a comfortable 200 days, rather than scrambling when it falls to 100.
Hosting providers occupy a useful middle layer here. Because a good host controls the web server, it can wire ACME issuance straight into the control panel and handle renewals silently. For the average website owner, that turns a genuinely disruptive standards change into something they never have to think about, no matter how far SSL certificate lifetimes eventually fall.
How to Respond to Shorter SSL Certificate Lifetimes
You do not need to panic, but you should act. First, confirm that your certificates renew automatically. If you handle renewals by hand or by calendar reminder, switch to an ACME-based or host-managed setup before the next cut in March 2027. Second, audit any certificate used for something other than a standard website – client authentication, internal APIs, or device identity – since those are the ones most exposed by the recent changes.
Third, check that your servers and email clients support TLS 1.2 or higher so the Exchange-style deprecations do not catch you off guard. None of this is heavy lifting, but ignoring shorter SSL certificate lifetimes is how a site ends up with a frightening expiry warning at the worst possible moment. If you are unsure where you stand, a hardened setup like the one described in our guide to hosting security removes most of the guesswork.
The Bottom Line
The direction is set and will not reverse. SSL certificate lifetimes are shrinking from over a year to 200 days today, then to 100, and finally to 47 days by 2029, with domain validation reuse tightening alongside. The July 2026 Let's Encrypt and Microsoft deadlines are early proof that the industry is enforcing these changes, not merely announcing them. The practical takeaway is simple: automate your renewals and stop treating certificates as set-and-forget.
If you would rather not think about any of this, let your host carry the load with fully managed, auto-renewing SSL certificate coverage that keeps shorter SSL certificate lifetimes invisible to you and your visitors.
Top comments (0)