Certificates and TLS

How long is an SSL certificate valid for?

If a page tells you an SSL certificate lasts 398 days, it was written before March 2026 and nobody has updated it. The limit has already moved once and it is scheduled to move twice more.

For a publicly trusted TLS certificate issued today, the maximum validity is 200 days. That limit took effect on 15 March 2026, replacing the 398-day maximum that had stood since September 2020. It falls again to 100 days for certificates issued on or after 15 March 2027, and to 47 days for those issued on or after 15 March 2029, under CA/Browser Forum ballot SC-081. A certificate issued before a cut keeps the lifetime it was issued with — the rules bind the issuer at the moment of issuance, not retroactively.

Worked out 2026-09-11 (IST) · publicly trusted TLS server certificates under the CA/Browser Forum Baseline Requirements

The schedule, in full

Maximum certificate lifetime by issuance date (ballot SC-081)
Certificates issued on or after	Maximum validity	Domain validation may be reused for
1 September 2020	398 days	398 days
15 March 2026	200 days	200 days
15 March 2027	100 days	100 days
15 March 2029	47 days	10 days

The right-hand column matters as much as the left. Domain control validation — the check that proves you control the name — may be cached and reused for a period, and that period shrinks alongside the certificate. From 2029, a reused validation is good for ten days, which means re-validating roughly every renewal. Manual processes do not survive that.

What each lifetime means for how you renew

Renewal cadence in practice
Lifetime	Renew at	Realistic process
398 days	Day ~350	A calendar reminder and an afternoon — and an outage every few years when someone leaves
200 days	Day ~165	Twice a year. Still survivable by hand, barely.
100 days	Day ~70	Three to four times a year. Automation or a dedicated owner.
47 days	Day ~30	Eight times a year. ACME automation is the only sane answer.

Where the numbers come from, and where to check yours

A certificate carries two timestamps, notBefore and notAfter, and its lifetime is the gap between them. Browsers reject the certificate outright once the clock passes notAfter — there is no grace period and no warning state, which is why an expiry is a total outage rather than a degradation. Both timestamps are published in the certificate and readable by anyone, so you can check any site’s remaining days without access to its server.

The three expiry-adjacent failures, distinguished
Browser says	Actual cause	Fix
Certificate has expired	The clock passed notAfter	Renew and reinstall; check the server clock too
Certificate is not yet valid	Server clock is wrong, or notBefore is in the future	Fix NTP on the server or the client
Issuer certificate is unknown	Intermediate chain not served	Install the full chain, not just the leaf
Certificate name mismatch	The hostname is not in the SAN list	Reissue with the right names

The last two are covered in why is my SSL certificate not trusted.

Sources: CA/Browser Forum Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, including ballot SC-081v3 “Introduce Schedule of Reducing Validity and Data Reuse Periods” (passed April 2025); IETF RFC 5280 and RFC 6125.

Check your own numbers

Check any site's certificate: issuer, the exact validity window, and days remaining.

SSL CheckerCertificate issuer, validity window, days remaining and chain.

Frequently asked

Does this apply to certificates I already have?

No. The schedule constrains what a certificate authority may issue on a given date, not what is already in the wild. A certificate issued on 1 March 2026 with a 398-day lifetime stays valid for its full 398 days. The practical effect is that the transition is gradual: your longest-lived old certificate sets the date by which you must have shorter renewals working.

Why are certificate lifetimes being shortened?

Two reasons, both about failure recovery. Certificate revocation has never worked reliably in browsers, so a compromised key can stay trusted for as long as the certificate lasts - a shorter lifetime is the only revocation mechanism that genuinely works. And short lifetimes force automation, which eliminates the expired-certificate outage that manual renewal produces every few years.

Do free certificates like Let's Encrypt last less time?

Let's Encrypt has issued 90-day certificates since it launched, long before any of these ballots, and now also offers a 6-day option. It has always been well inside the limit, which is why sites using it are unaffected by the schedule - their renewal was already automated. The organisations affected are those buying one-year certificates and installing them by hand.

What about internal or private CA certificates?

The Baseline Requirements govern publicly trusted certificates - the ones chaining to a root that ships in browsers and operating systems. A private CA you run for internal services is outside that scope and can issue whatever lifetime you choose. Whether it should is a different question; the arguments for short-lived certificates apply just as well inside a network.

Need domain and DNS checks inside your own product?

We build WHOIS, RDAP, DNS and SSL lookups as embeddable widgets or a plain JSON API in your branding, wired to your own lead form. Tell us which checks you need and we will send a working demo.