SSL/TLS certificate news
What changed in the certificate ecosystem, when it takes effect and what you need to do, with every date checked against the official announcement.
Certificate news on ssl.sh covers four kinds of change to publicly trusted TLS certificates: CA/Browser Forum ballots that amend the Baseline Requirements, browser root program decisions such as distrusting a CA, incidents at individual certificate authorities, and changes at Let's Encrypt, the most widely used ACME CA.
Each article answers three questions: what happened, who is affected and what you should do, with commands you can run against your own servers. Every date is checked against the official source listed at the end of the article, and dates that have not arrived yet are marked as upcoming. As of November 2026, newly issued public TLS certificates are limited to 200 days.
For the full sequence of lifetime changes see the certificate validity timeline. Let's Encrypt changes are collected in the Let's Encrypt timeline, and browser trust decisions in the root program timeline. To check what your own site serves right now, use the SSL checker.
Industry policy
200-day TLS certificate limit in force since 15 March 2026
From 2026-03-15 publicly trusted TLS certificates are capped at 200 days and domain validation reuse at 200 days. Next step: 100 days in March 2027.
Ballot SC-081: TLS certificates fall to 47 days by 2029
Ballot SC-081v3 cuts maximum TLS certificate validity from 398 to 200, 100 and finally 47 days between 2026 and 2029, and shortens validation reuse.
Multi-perspective domain validation (MPIC) becomes mandatory
Ballot SC-067v3 requires CAs to check domain control and CAA from several network locations, phased in from March 2025 to December 2026.
Browsers & root programs
Chrome begins phasing out CA hierarchies not dedicated to TLS
Chrome Root Program Policy v1.8: from 2026-06-15 new subordinate CAs must be serverAuth-only; from 2027-03-15 leaf certificates must be too.
Entrust distrust: Chrome, Mozilla and Apple reject new certs
Chrome 131+ distrusts Entrust/AffirmTrust TLS certificates whose earliest SCT is after 2024-11-11; Mozilla and Apple set their own cutoff dates.
Certificate authorities
Let's Encrypt
Let's Encrypt certificates drop TLS client authentication
Since 2026-02-11 Let's Encrypt's default classic profile omits the clientAuth EKU; the temporary tlsclient profile ended on 2026-07-08.
Let's Encrypt six-day and IP address certificates available
Since 2026-01-15 Let's Encrypt issues six-day (160-hour) certificates and IPv4/IPv6 address certificates via the opt-in shortlived profile.
Let's Encrypt to cut certificate lifetimes from 90 to 45 days
ISRG plan: 45-day certs on the tlsserver profile from May 2026, a 64-day default from Feb 2027, then 45 days with 7-hour authz reuse from Feb 2028.
Let's Encrypt introduces Generation Y roots and intermediates
New roots ISRG Root YR (RSA-4096) and ISRG Root YE (ECDSA P-384), cross-signed by their predecessors, plus six intermediates without clientAuth.
Let's Encrypt shuts down OCSP and moves revocation to CRLs
Let's Encrypt switched off its OCSP responders on 2025-08-06, dropped OCSP URLs and Must-Staple in May 2025, and now publishes revocation via CRLs.
Let's Encrypt ends certificate expiration reminder emails
Let's Encrypt ended expiration reminder emails on 2025-06-04, announced on 2025-01-22. It recommends automated renewal plus independent monitoring.
FAQ
How are the dates in these articles verified?
Each date comes from the primary source: the CA/Browser Forum ballot or Baseline Requirements, the browser vendor's policy or announcement, or the CA's own post. Those sources are linked at the end of every article.
Where can I see all certificate lifetime changes in one place?
The certificate validity timeline lists every scheduled maximum-validity step, including the 200-, 100- and 47-day limits set by Ballot SC-081.