SSL Certificate Lifetimes Are Shrinking: What to Do Now
An SSL certificate used to be something you bought once a year and then forgot about until the reminder email arrived. That routine is ending. The industry has agreed to shorten how long public certificates can last, and the first reduction is already in force. This guide explains the schedule, what it changes for different kinds of website owners, and how to prepare without panic.
Table of contents
Executive Summary
The CA/Browser Forum has set a staged cut in the maximum validity of publicly trusted TLS certificates: 200 days, then 100 days, then 47 days. Domain validation data is also reused for less time. Working certificates keep working, but renewals become more frequent, so knowing who renews each certificate, and whether that is automated, is now part of basic website maintenance.
Quick Answer
Publicly trusted SSL/TLS certificates issued on or after March 15, 2026 can be valid for at most 200 days. The limit falls to 100 days for certificates issued on or after March 15, 2027, and to 47 days from March 15, 2029. Check each certificate's expiry date and find out whether its renewal is automatic.
What is changing and when
The schedule comes from the CA/Browser Forum Baseline Requirements, the rules that publicly trusted certificate authorities follow. It was introduced by Ballot SC-081v3, whose vote closed on April 11, 2025. The limits apply by issue date, so each step affects certificates issued on or after the date shown.
| Certificate issue date | Maximum validity | Renewals per year at the limit | Domain validation reuse |
|---|---|---|---|
| Before 15 Mar 2026 | 398 days | About 1 | 398 days |
| 15 Mar 2026–14 Mar 2027 | 200 days | About 2 | 200 days |
| 15 Mar 2027–14 Mar 2029 | 100 days | About 4 | 100 days |
| On or after 15 Mar 2029 | 47 days | About 8 | 10 days |
The 200-day limit has applied to newly issued certificates since March 15, 2026. The next step, to 100 days, applies from March 15, 2027. The renewals column is simple arithmetic: 365 divided by the validity period, rounded for readability.
Why the reduction matters in practice
The general idea behind shorter lifetimes is that a certificate, and the proof that someone controls a domain, should not be trusted for longer than necessary. For a website owner the effect is more concrete: a task that happened once a year will happen at least twice a year, then four times, then roughly eight.
Domain validation reuse is the quieter part of the change. Before issuing a certificate, a certificate authority checks that you control the domain. The reuse period is how long that check can be relied on without repeating it. As it shrinks from 398 days to 10 days, a manual approval step, such as clicking an email link or adding a DNS record by hand, comes around much more often. That is why automation becomes the practical answer.
What it means for your setup
Where you get your certificate decides how much work you inherit.
Certificates included with hosting
Z.com US lists a free SSL certificate on its paid web hosting plans and on its WordPress hosting plans. The hosting page says you may need to set your domain's name servers to Z.com's name servers to use the free SSL. The pages reviewed for this article do not say whether issuance and renewal are automatic, so confirm that in your account or with Z.com support instead of assuming it.
Certificates you buy separately
Z.com US also offers GlobalSign certificates on its SSL certificates page: Alpha SSL and Standard SSL with domain validation, Business SSL with organization validation, and Premium SSL with extended validation. The page lists typical issuance times of about 5 minutes for domain-validated certificates, 1 to 2 days for Business SSL and 3 to 5 days for Premium SSL. It also refers to a 199-day renewal cycle, which matches the 199-day maximum GlobalSign says it applies, one day inside the 200-day industry limit. The issuance times are estimates. What must be re-confirmed at renewal, and how long that takes, depends on how long validated information can be reused and on the provider's process, so ask your provider and start organization or extended validation renewals earlier than a domain-validated one.
Certificates you install yourself
If you manage servers, a load balancer, a mail server or a staging site, each manually installed certificate is a separate renewal. These are the ones most likely to expire unnoticed as the interval shortens.
A practical preparation checklist
- List every certificate you use, including the main site, subdomains, staging sites, email and API endpoints.
- Record the expiry date, the provider, and the person responsible for each renewal.
- Find out whether each renewal is automatic, what it covers (payment, issuance, domain validation, installation on the server), and who is notified if it fails.
- Keep access to the DNS records and the email address used for domain validation.
- Set a reminder well before expiry, not on the expiry date itself.
- Compare the renewal log with the expiry date of the certificate your site actually serves, and add monitoring that alerts a named person if a renewal does not complete.
- Allow extra lead time for organization or extended validation certificates.
- Review the list again before March 15, 2027, when the limit drops to 100 days.
Common mistakes to avoid
Assuming a renewal is automatic
Many hosts renew certificates for you, but the assumption needs checking. A silent failure shows visitors a browser warning instead. Our guide to the "Your Connection Is Not Private" error explains what visitors see.
Forgetting certificates outside the main website
Mail servers, staging sites and API endpoints often use their own certificates. They are easy to miss in a renewal routine.
Confusing the purchase term with the certificate's validity
A purchase term and a certificate's validity are different things. A certificate issued on or after March 15, 2026 can last at most 200 days, so ask how reissues within your term are handled.
Losing control of the domain's DNS
If name servers change or the validation email address no longer works, a renewal can stall. Keep that access current.
Frequently asked questions
Do I need to replace my current certificate now?
No. The limits are tied to the issue date, so you do not need to replace a working certificate only because of this rule change. It stays valid until it expires, unless it is revoked or has another problem. Check its expiry date and plan the renewal under the current rules.
Do free certificates follow the same limits?
The Baseline Requirements apply to publicly trusted certificates in general, so a free certificate from a hosting provider falls under the same schedule. Whether renewal is automatic depends on your provider.
Will certificates really last only 47 days?
That is the limit in the schedule for certificates issued on or after March 15, 2029. Rules can be revised, so check the Baseline Requirements before you plan around that date.
Does this affect certificates from a private internal authority?
The Baseline Requirements are written for publicly trusted certificate authorities, so private internal certificates are governed by your own policy. Confirm the details with whoever runs that authority.
Key Takeaways
- The 200-day limit is already in force, with 100 days next on March 15, 2027.
- Each step means more renewals, so list your certificates and their owners.
- Shorter domain validation reuse makes manual approvals recur, so favor automation.
- Do not assume renewal is automatic. Confirm it with your provider.
Official references
These sources support the schedule and the Z.com details above. Open them for the full wording.
Review your SSL options
See the certificate types Z.com US offers, then check how renewal is handled for the one you use.
View Z.com US SSL certificates