Wildcards, multi-year and pricing
Multi-year SSL certificates after the 200-day limit
A multi-year SSL certificate no longer exists as a single certificate: since 15 March 2026 no publicly trusted TLS certificate may last more than 200 days. A "2-year" or "5-year" plan is a prepaid subscription with repeated reissues. It is worth buying for the lower yearly price only if reinstalling the certificate is automated or cheap for you.
The new schedule
The CA/Browser Forum limit falls to 100 days on 15 March 2027 and 47 days on 15 March 2029, so by 2029 a site needs at least 8 certificates a year.
| From | Maximum validity | Certificates per year (at least) |
|---|---|---|
| 15 March 2026 | 200 days | 2 |
| 15 March 2027 | 100 days | 4 |
| 15 March 2029 | 47 days | 8 |
Domain validation reuse shrinks along the same path and reaches 10 days in 2029, so most reissues will also require a new domain check. Use the validity calculator to see the maximum lifetime for a given issue date, and the validity timeline for background.
Do multi-year subscriptions cost less?
Often, but not always. Per-year prices verified on 10 November 2026:
| Product | 1 year | Longest term, per year |
|---|---|---|
| Namecheap Standard SSL | $11.00 | $5.99 (5 years) |
| Namecheap EV SSL | $76.99 | $45.99 (5 years) |
| SSL.com Basic SSL | $49.00 | $36.75 (5 years) |
| Sectigo DV SSL at The SSL Store | $75.00 | $60.00 (5 years) |
| SSL.com EV Code Signing | $349.00 | $149.00 (5 years) |
Trustico, by contrast, charged exactly twice the 12-month price for 24 months on every product we checked, so a longer term there only saves you a renewal step.
Risks of prepaying
Prepaying trades a lower price for more installs and exposure to seller changes:
- More installs, not fewer. A 5-year subscription bought in late 2026 spans roughly 30 certificates as the limits tighten. If each one is installed by hand, the time cost outweighs the saving.
- Seller or CA changes. Namecheap switched its issuing CA from Sectigo to SSL.com on 11 July 2026; existing certificates kept working, and unused ones were replaced with equivalent products. Other changes, such as a browser distrusting a CA, can force early replacement.
- Validation data expires. OV and EV organization details must be re-verified periodically even within a subscription.
Who should buy multi-year
Buy multi-year if you need a paid certificate anyway (OV, EV, a specific brand), your server can fetch reissued certificates automatically (ideally through ACME, which several commercial CAs support), and you want to lock in a lower yearly price. If you are choosing between a paid DV subscription and a free ACME certificate, the free one with automation is usually simpler; see free vs paid SSL.
FAQ
Can I still buy a 2-year SSL certificate?
You can buy a 2-year (or up to 5-year) subscription, but no single certificate can be valid that long. Since 15 March 2026 each certificate lasts at most 200 days, so the seller reissues it during the subscription.
Do I have to validate my domain again for each reissue?
Increasingly often. Ballot SC-081 also shortens how long domain validation can be reused, ending at 10 days in 2029, so reissues will usually need a fresh domain check. That is another reason to automate.
What happens to my subscription if the CA changes?
It depends on the seller. When Namecheap moved from Sectigo to SSL.com on 11 July 2026, existing certificates kept working and unused ones activated afterwards were replaced with the equivalent SSL.com product.
Sources
This page contains affiliate links. We may earn a commission at no extra cost to you. Learn more