SSL Certificates Are Shrinking to 47 Days: What Website Owners Must Automate

An SSL certificate is the file that lets a browser show the padlock and encrypt traffic to your website. For years you could buy one and forget it for a year. That habit is ending. The industry body that sets the rules for certificates has agreed to cut the maximum lifetime step by step, and the final step is only 47 days.

What was decided, and by whom

The CA/Browser Forum is the group where browser makers and certificate authorities (the companies that issue certificates) agree shared rules. Its ballot SC-081v3, proposed by an Apple representative and endorsed by people from Sectigo, Google Chrome and Mozilla, introduced a schedule of shorter lifetimes. The Forum's own record says the ballot became effective on 16 May 2025.

The schedule for the maximum lifetime of a publicly trusted website certificate is:

• Until 14 March 2026: 398 days, the limit most owners were used to.
• From 15 March 2026: 200 days.
• From 15 March 2027: 100 days.
• From 15 March 2029: 47 days.

The same schedule shortens how long a certificate authority may reuse proof that you control a domain, ending at 10 days in 2029. In practice, that means more frequent checks behind the scenes, not just a shorter file.

As of November 2026 the first step has already taken effect, so a newly issued certificate from a public authority should not be valid for more than 200 days. These limits apply to certificates issued from those dates; existing certificates keep running until they expire.

Why the industry is doing this

Shorter lifetimes limit the damage when a certificate is issued by mistake or a private key leaks, because the bad certificate dies sooner. Let's Encrypt, the free certificate authority many hosts use, says the same on its lifetimes page: shorter lifetimes reduce that risk and push everyone towards automation. It issues 90-day certificates by default, offers 6-day certificates on request, and plans to cut its own maximum to 45 days by February 2028.

Who has to care, and who does not

This is a real change only if a person renews your certificate by hand. Three common situations:

• Managed hosting with built-in certificates. Platforms such as Vercel, Netlify, Cloudflare and most good shared hosts issue and renew certificates for you. The shorter lifetime changes nothing you see.
• A purchased certificate installed on a server. If someone buys a one-year certificate and uploads it, the yearly routine becomes twice a year now, four times a year in 2027, and roughly eight times a year in 2029. Each missed renewal means a browser warning that scares customers away.
• Devices and old systems. Certificates inside billing servers, intranet portals, IoT gateways or a vendor's appliance are the ones most likely to be forgotten.

A small brochure site on a managed platform can relax. A business with several domains, a custom server and a paid certificate should start planning now.

What breaks with manual certificates

A manual renewal depends on a calendar reminder, an email to someone who may have left, and a person who remembers how to install the file. Expired certificates cause browser warnings, failed payment callbacks, broken mobile apps that refuse an invalid connection, and API partners who cannot reach you. The failure also tends to happen at night or on a holiday. With 47-day certificates, a process that works only if everyone remembers will fail eventually.

A plain checklist to prepare

1. List every domain and subdomain you use, including the ones for your app's API, admin panel, staging site and email links.
2. Write down, for each, who issues the certificate and who renews it today.
3. Move to automated issuance wherever you can, using your host's built-in certificates or the ACME protocol, the standard automatic renewal method that Let's Encrypt and other authorities support.
4. Set up expiry monitoring that emails more than one person, so a single absence does not matter.
5. Check that your DNS setup allows automatic domain checks, since the renewal process proves you control the domain.
6. Test renewals before the live expiry, not on the last day.
7. For devices that cannot automate, ask the vendor for their plan, and budget for replacement if there is none.

How we handle it at VS Tech Builders

Hosting platforms we use for client websites, such as Vercel, manage certificates automatically. Where a client has a server of their own, we set up automatic renewal and monitoring as part of website development or the yearly renewal covered in our pricing plans. The point is that nobody should have to remember a date.

What is still uncertain

The schedule above is what the Forum has adopted, but individual authorities may move faster than the minimum, and the Baseline Requirements text can be revised by later ballots. Keep an eye on your certificate provider's announcements and the Forum's site. For more explainers like this, visit our tech news hub.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• Results of Review Period – Ballot SC081v3 — CA/Browser Forum Server Certificate Working Group
• Voting Period Begins: SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods — CA/Browser Forum Server Certificate Working Group
• Certificate Lifetime Rationale and Plans — Let's Encrypt
• Root Causes 486: 47-Day Maximum Term Ballot Passes CABF — Sectigo

Frequently asked questions

When do SSL certificates become 47 days long?

Under the CA/Browser Forum schedule, the maximum validity drops to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Certificates issued before each date keep running until they expire. Individual providers may move earlier, so check your authority's announcements.

Will my website go down if I do nothing?

Not if your host renews certificates automatically, which is the case on most modern platforms. If you buy a certificate and install it by hand, you will need to renew more often, and a missed renewal shows a browser security warning. Check who renews yours and whether it is automated.

Do these rules affect private or internal certificates?

The schedule applies to publicly trusted website certificates governed by the Baseline Requirements. Certificates from your own internal authority are not set by this ballot, although the same automation habits help. Internal tools and devices are often forgotten, so list them anyway when you plan renewals.

What is ACME and do I need to know it?

ACME is the standard protocol that lets a server request and renew certificates automatically, and Let's Encrypt popularised it. You rarely need to learn it yourself. You only need to confirm that your host or developer has it, or an equivalent managed renewal, switched on and monitored.