# SSL/TLS Certificate Timelines: Validity, Let's Encrypt, Root Programs

> Dated, sourced timelines of TLS certificate rule changes: maximum validity (200 → 100 → 47 days), Let's Encrypt changes and browser root program decisions.

Source: https://ssl.sh/timeline/
Last updated: 2026-11-10

Every date that changes how long certificates last, which CAs browsers trust and what Let's Encrypt issues, checked against official sources. Each event is marked in effect or upcoming.

## Key points

- Publicly trusted TLS certificates issued since March 15, 2026 can be valid for at most 200 days; the limit becomes 100 days on March 15, 2027 and 47 days on March 15, 2029.
- Let's Encrypt's default certificates move from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028.
- Chrome requires subscriber certificates issued from March 15, 2027 to assert only the serverAuth EKU, and removes roots whose keys are more than 15 years old.
- From December 15, 2026, CAs must corroborate domain validation from at least 5 remote network perspectives (MPIC).

## [Certificate validity timeline](https://ssl.sh/timeline/certificate-validity/)

Maximum TLS certificate lifetime by issuance date: 200 days since March 15, 2026, 100 days from March 2027 and 47 days from March 2029 (Ballot SC-081v3).

## [Let's Encrypt timeline](https://ssl.sh/timeline/lets-encrypt/)

Let's Encrypt changes by date: OCSP shut down (Aug 2025), expiry emails ended, six-day and IP certificates, 64-day (2027) and 45-day (2028) certificates.

## [Root program changes](https://ssl.sh/timeline/root-program-changes/)

When browsers distrusted Symantec, Entrust, Chunghwa, NetLock and eMudhra roots, plus Chrome's serverAuth-only, root-age and CT rules, by date.

## Upcoming changes (November 10, 2026)

- November 12, 2026: DigiCert issues from its G5 TLS roots by default — https://ssl.sh/timeline/root-program-changes/#e-2026-11-12
- November 16, 2026: Chrome stops trusting new emSign Root CA - G1 certificates — https://ssl.sh/timeline/root-program-changes/#e-2026-11-16
- December 15, 2026: MPIC: at least 5 remote perspectives — https://ssl.sh/timeline/root-program-changes/#e-2026-12-15
- February 10, 2027: Let's Encrypt default certificates drop to 64 days — https://ssl.sh/timeline/certificate-validity/#e-2027-02-10
- February 10, 2027: Default certificates: 64 days, 10-day authorization reuse — https://ssl.sh/timeline/lets-encrypt/#e-2027-02-10
- March 15, 2027: 100-day maximum; domain validation reusable for 100 days — https://ssl.sh/timeline/certificate-validity/#e-2027-03-15
- March 15, 2027: Chrome: leaf certificates must be serverAuth-only — https://ssl.sh/timeline/root-program-changes/#e-2027-03-15
- April 15, 2027: Next 15-year root removals (keys from 2008–2009) — https://ssl.sh/timeline/root-program-changes/#e-2027-04-15
- September 15, 2027: At most two roots per CA owner in Chrome — https://ssl.sh/timeline/root-program-changes/#e-2027-09-15
- February 16, 2028: Let's Encrypt default certificates drop to 45 days — https://ssl.sh/timeline/certificate-validity/#e-2028-02-16
- February 16, 2028: Default certificates: 45 days, 7-hour authorization reuse — https://ssl.sh/timeline/lets-encrypt/#e-2028-02-16
- March 15, 2029: 47-day maximum; domain validation reusable for only 10 days — https://ssl.sh/timeline/certificate-validity/#e-2029-03-15

## FAQ

### How is the status of each event decided?

An event is marked in effect when its date is on or before the date the page was generated, and upcoming otherwise. Pages are regenerated regularly, and the generation date is shown at the top of each timeline.

### Where do the dates come from?

From primary sources only: CA/Browser Forum ballots and Baseline Requirements, the Chrome Root Program policy, Google, Mozilla and Apple announcements, and Let's Encrypt / ISRG posts. Each event links to its source.