SSL/TLS timelines

Upcoming changes

1. November 12, 2026Upcoming

   DigiCert issues from its G5 TLS roots by default

   DigiCert plans to make DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 its default issuing hierarchies (postponed from October 15, 2026).

   Who is affected: DigiCert customers and clients with custom trust stores that may lack the G5 roots.

   Source: DigiCert: Root strategy aligning with industry standards

2. November 16, 2026Upcoming

   Chrome stops trusting new emSign Root CA - G1 certificates

   Chrome 153 and later will not trust certificates chaining to emSign Root CA - G1 whose earliest SCT is after November 16, 2026, 23:59:59 UTC.

   Who is affected: Sites with certificates chaining to emSign Root CA - G1; switch CAs before renewing.

   Source: Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates

3. December 15, 2026Upcoming

   MPIC: at least 5 remote perspectives

   The last MPIC phase requires CAs to corroborate domain validation and CAA from at least 5 remote network perspectives, at least 500 km apart.

   Who is affected: Sites with strict inbound firewall rules on validation paths.

   Source: CA/Browser Forum Baseline Requirements

4. February 10, 2027UpcomingLet's Encrypt

   Let's Encrypt default certificates drop to 64 days

   Let's Encrypt's default classic profile is scheduled to issue 64-day certificates and to reuse authorizations for only 10 days.

   Who is affected: Most Let's Encrypt users (certbot, acme.sh, panels and hosting providers using the default profile).

   Source: ISRG: From 90 to 45 days

5. February 10, 2027Upcoming

   Default certificates: 64 days, 10-day authorization reuse

   The classic profile is scheduled to issue 64-day certificates and to reuse domain authorizations for only 10 days.

   Who is affected: Most Let's Encrypt users.

   Source: ISRG: From 90 to 45 days

6. March 15, 2027Upcoming

   100-day maximum; domain validation reusable for 100 days

   Certificates issued on or after March 15, 2027 can be valid for at most 100 days, and domain validation can be reused for at most 100 days.

   Who is affected: Everyone still renewing manually: about four renewals a year.

   Source: CA/Browser Forum Baseline Requirements

7. March 15, 2027Upcoming

   Chrome: leaf certificates must be serverAuth-only

   Subscriber certificates issued on or after March 15, 2027 that chain to the Chrome Root Store must include the EKU extension with serverAuth only. Subordinate CAs must also be integrated with an automation solution.

   Who is affected: Anyone still ordering public TLS certificates with clientAuth; move client authentication to a [private CA](term:private-ca).

   Source: Chrome Root Program Policy, Version 1.8

8. April 15, 2027Upcoming

   Next 15-year root removals (keys from 2008–2009)

   Roots whose key material was generated in 2008–2009 are scheduled for removal from the Chrome Root Store around April 15, 2027.

   Who is affected: Customers of CAs still issuing from roots of that age.

   Source: Chrome Root Program Policy, Version 1.8

9. September 15, 2027Upcoming

   At most two roots per CA owner in Chrome

   The Chrome Root Store will include at most two root certificates per CA owner, pushing CAs to consolidate on new dedicated TLS roots.

   Who is affected: CAs with many legacy roots, and clients that pin specific roots.

   Source: Chrome Root Program Policy, Version 1.8

10. February 16, 2028UpcomingLet's Encrypt

    Let's Encrypt default certificates drop to 45 days

    Let's Encrypt's classic profile is scheduled to issue 45-day certificates, with authorization reuse cut to 7 hours, so practically every renewal re-validates the domain.

    Who is affected: All Let's Encrypt users on the default profile; renew based on [ARI](term:ari), not a fixed 60-day timer.

    Source: ISRG: From 90 to 45 days

11. February 16, 2028Upcoming

    Default certificates: 45 days, 7-hour authorization reuse

    The classic profile is scheduled to issue 45-day certificates and to reuse authorizations for only 7 hours, so each renewal effectively validates the domain again. Renew with ARI.

    Who is affected: All Let's Encrypt users on the default profile.

    Source: ISRG: From 90 to 45 days

12. March 15, 2029Upcoming

    47-day maximum; domain validation reusable for only 10 days

    Certificates issued on or after March 15, 2029 can be valid for at most 47 days, and domain validation can be reused for at most 10 days. Manual renewal is no longer realistic at this point; see 47-day certificates.

    Who is affected: Every operator of publicly trusted TLS certificates, including appliances, load balancers and CDNs that are hard to automate.

    Source: CA/Browser Forum Baseline Requirements

Recently in effect

• October 20, 2026In effectCompromised eMudhra intermediates; emSign ECC Root CA - G3 removed
• July 8, 2026In effecttlsclient profile discontinued
• July 1, 2026In effectChrome removes three non-dedicated DigiCert roots
• June 15, 2026In effectChrome: dedicated TLS hierarchies and pre-issuance CT logging
• June 3, 2026In effectAll server-certificate profiles issue from Gen Y or ISRG Root X2
• May 13, 2026In effectLet's Encrypt tlsserver profile moves to 45-day certificates
• May 13, 2026In effecttlsserver profile issues 45-day certificates
• April 15, 2026In effectFirst 15-year root removals (keys from 2006–2007)