# SC-081v3: TLS certificate lifetimes drop to 47 days by 2029

> SC-081v3 cuts the maximum TLS certificate validity from 398 to 200, 100 and finally 47 days, and domain validation reuse to 10 days, by March 2029.

Source: https://ssl.sh/ballots/sc-081/
Last updated: 2026-11-10

SC-081v3 is the ballot that ends the one-year TLS certificate. It sets a schedule that lowers the maximum validity of publicly trusted TLS certificates from 398 days to 200 days on 2026-03-15, 100 days on 2027-03-15 and 47 days on 2029-03-15, and shortens how long a CA may reuse domain validation to 10 days by 2029.

## What changed

SC-081v3 rewrote two parts of the [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/): the maximum certificate lifetime (§6.3.2) and the data reuse periods (§4.2.1). Before it, a certificate could live 398 days, domain and IP address validation could be reused for 398 days, and validated organization details for 825 days. The ballot was proposed by Apple and endorsed by Sectigo, Google Chrome and Mozilla. The argument in the ballot text: shorter lifetimes limit how long a mis-issued or compromised certificate stays usable, and they push everyone toward automation.

## Effective dates

SC-081v3 lowers both limits in three steps, by certificate issue date:

| Issued on or after | Max validity | Domain/IP validation reuse |
|---|---|---|
| until 2026-03-14 | 398 days | 398 days |
| 2026-03-15 | 200 days | 200 days |
| 2027-03-15 | 100 days | 100 days |
| 2029-03-15 | 47 days | 10 days |

Subject identity information (the organization data in OV and EV certificates) may be reused for 398 days from 2026-03-15. As of November 2026 the first step is already in force.

## Who is affected

Every publicly trusted TLS server certificate is covered, whether DV, OV or EV, free or paid. Certificates already issued keep their original expiry date; the limits apply to the issue date. Private PKI and internal CAs are not covered. Operators who install certificates by hand, appliances that need a manual upload and contracts that assume yearly renewal feel it most. Sites using [ACME](https://ssl.sh/glossary/acme/) clients that renew every 60 days or so are mostly unaffected until the 47-day step.

## What to do

Automate renewal now: use an ACME client such as certbot or acme.sh, or your provider's managed certificates, and alert on expiry with a [monitor](/monitor/). Check that your renewal job also reloads the web server. Because domain validation will only be reusable for 10 days from 2029, prefer validation methods your automation can repeat, such as [DNS-01](https://ssl.sh/glossary/dns-01/) with an API-driven DNS provider. See the [certificate validity timeline](https://ssl.sh/timeline/certificate-validity/) for the history from 5 years to 47 days.


| Field | Value |
|---|---|
| Ballot | SC-081v3 |
| Status | Passed |
| Adopted | 2025-04-11 |
| Effective | 2025-05-16 |
| BR version | 2.1.5 |
| Official page | https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/ |