# TLS Certificate Validity Timeline: 398 → 200 → 100 → 47 Days > Maximum TLS certificate lifetime by issuance date: 200 days since March 15, 2026, 100 days from March 2027 and 47 days from March 2029 (Ballot SC-081v3). Source: https://ssl.sh/timeline/certificate-validity/ Last updated: 2026-11-10 Publicly trusted TLS certificates issued on or after March 15, 2026 can be valid for at most 200 days. Under CA/Browser Forum Ballot SC-081v3 the limit falls to 100 days in March 2027 and 47 days in March 2029, and domain validation can be reused for only 10 days by then. Status as of November 10, 2026 ## Key points - Since March 15, 2026, publicly trusted TLS certificates can be valid for at most 200 days (CA/Browser Forum Ballot SC-081v3). - The maximum drops to 100 days for certificates issued from March 15, 2027 and to 47 days for certificates issued from March 15, 2029. - Domain validation can be reused for 200 days from March 15, 2026, 100 days from March 15, 2027 and only 10 days from March 15, 2029. - The limits apply by issuance date: a certificate issued before a cut-off keeps its original expiry date. - The maximum was 60 months in 2012, 39 months in 2015, 825 days in 2018 and 398 days from September 1, 2020. ## Timeline ### July 1, 2012 — Baseline Requirements take effect: 60 months maximum (In effect) The CA/Browser Forum [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/) became the common rulebook for publicly trusted CAs. Certificates issued after July 1, 2012 could be valid for at most 60 months. Who is affected: All publicly trusted CAs and the sites that buy certificates from them. Source: [CA/Browser Forum: Baseline Requirements FAQ](https://cabforum.org/working-groups/server/baseline-requirements/faq/) ### April 1, 2015 — Maximum validity cut to 39 months (In effect) Certificates issued after April 1, 2015 could be valid for at most 39 months, ending the era of five-year TLS certificates. Who is affected: CAs and customers buying multi-year certificates. Source: [CA/Browser Forum: Baseline Requirements FAQ](https://cabforum.org/working-groups/server/baseline-requirements/faq/) ### March 1, 2018 — 825-day maximum (Ballot 193) (In effect) Ballot 193, adopted in March 2017, limited certificates issued after March 1, 2018 to 825 days (about 27 months). Who is affected: CAs and customers buying two- and three-year certificates. Source: [CA/Browser Forum Ballot 193: 825-day Certificate Lifetimes](https://cabforum.org/2017/03/17/ballot-193-825-day-certificate-lifetimes/) ### September 1, 2020 — 398-day maximum enforced by browsers (In effect) Apple, then Google and Mozilla, rejected certificates issued on or after September 1, 2020 with a validity of more than 398 days. The CA/Browser Forum added the same limit to the Baseline Requirements with Ballot SC31 in July 2020. One-year certificates became the norm. Who is affected: Every site using publicly trusted certificates; two-year certificates were no longer sold. Source: [Apple: About upcoming limits on trusted certificates](https://support.apple.com/en-us/102028); [Mozilla Security Blog: Reducing TLS Certificate Lifespans to 398 Days](https://blog.mozilla.org/security/2020/07/09/reducing-tls-certificate-lifespans-to-398-days/) ### April 11, 2025 — Ballot SC-081v3 passes: 200, 100, then 47 days (In effect) The CA/Browser Forum Server Certificate Working Group adopted Ballot SC-081v3, proposed by Apple (voting ended April 11, 2025: certificate issuers 25 yes, 0 no, 5 abstain; certificate consumers 4 yes). It set a schedule cutting the maximum validity to 200, 100 and 47 days and the domain-validation reuse period to 200, 100 and 10 days. Who is affected: All publicly trusted TLS CAs, and every organisation that still renews certificates by hand. Source: [CA/Browser Forum Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) ### March 15, 2026 — 200-day maximum; domain validation reusable for 200 days (In effect) Certificates issued on or after March 15, 2026 can be valid for at most 200 days, and CAs can reuse a [domain validation](https://ssl.sh/glossary/dcv/) for at most 200 days (down from 398). From the same date a [short-lived certificate](https://ssl.sh/glossary/short-lived-certificate/), which needs no revocation information, is one valid for 7 days or less. Who is affected: Anyone buying one-year certificates: a yearly purchase now needs at least one mid-term reissue. Source: [CA/Browser Forum Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/); [CA/Browser Forum Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) ### May 13, 2026 — Let's Encrypt tlsserver profile moves to 45-day certificates (In effect) Let's Encrypt's opt-in tlsserver ACME profile began issuing 45-day certificates, ahead of the change to its default profile. Who is affected: ACME clients that explicitly request the tlsserver profile. Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ### February 10, 2027 — Let's Encrypt default certificates drop to 64 days (Upcoming) Let's Encrypt's default classic profile is scheduled to issue 64-day certificates and to reuse authorizations for only 10 days. Who is affected: Most Let's Encrypt users (certbot, acme.sh, panels and hosting providers using the default profile). Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ### March 15, 2027 — 100-day maximum; domain validation reusable for 100 days (Upcoming) Certificates issued on or after March 15, 2027 can be valid for at most 100 days, and domain validation can be reused for at most 100 days. Who is affected: Everyone still renewing manually: about four renewals a year. Source: [CA/Browser Forum Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/) ### February 16, 2028 — Let's Encrypt default certificates drop to 45 days (Upcoming) Let's Encrypt's classic profile is scheduled to issue 45-day certificates, with authorization reuse cut to 7 hours, so practically every renewal re-validates the domain. Who is affected: All Let's Encrypt users on the default profile; renew based on [ARI](term:ari), not a fixed 60-day timer. Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ### March 15, 2029 — 47-day maximum; domain validation reusable for only 10 days (Upcoming) Certificates issued on or after March 15, 2029 can be valid for at most 47 days, and domain validation can be reused for at most 10 days. Manual renewal is no longer realistic at this point; see [47-day certificates](https://ssl.sh/learn/47-day-certificates/). Who is affected: Every operator of publicly trusted TLS certificates, including appliances, load balancers and CDNs that are hard to automate. Source: [CA/Browser Forum Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/) ## FAQ ### Do I have to replace my certificate when a new limit takes effect? No. The limits apply to certificates issued on or after each date. A 398-day certificate issued on March 14, 2026 stays valid until its own expiry date; only its replacement is capped at 200 days. ### Why is certificate validity being shortened? Shorter lifetimes limit how long a mis-issued certificate or a stolen private key stays usable, keep domain-validation data fresh, and force automation, which makes it practical to replace certificates or algorithms quickly. Revocation checking has never been reliable enough to do that job alone. ### Will I have to validate my domain every 10 days from 2029? The CA must re-validate domain control if its previous validation is more than 10 days old, so in practice every renewal will include a fresh validation. With [ACME](https://ssl.sh/glossary/acme/) automation (HTTP-01, DNS-01 or TLS-ALPN-01) this happens automatically; manual email or file-based validation will become a burden. ### Does this apply to private CAs, code signing or S/MIME certificates? No. SC-081v3 changes the Baseline Requirements for publicly trusted TLS server certificates. Certificates from your own [private CA](https://ssl.sh/glossary/private-ca/) and other certificate types follow their own rules. ### How long are Let's Encrypt certificates? Let's Encrypt's default profile issues 90-day certificates as of November 2026. It plans 64 days from February 10, 2027 and 45 days from February 16, 2028; its opt-in tlsserver profile has issued 45-day certificates since May 13, 2026. See the [Let's Encrypt timeline](https://ssl.sh/timeline/lets-encrypt/).