SSL Certificate Validity Drops to 100 Days in 2027: What Site Owners Must Do

SSL certificate validity changes are coming fast: from March 15, 2027, a public SSL/TLS certificate can last no more than 100 days, half of today's 200-day limit. Let's Encrypt, the free certificate authority many hosts use, cuts its default to 64 days on February 10, 2027.

This page explains the dates and where each comes from, who needs to act, and a checklist to make sure your site never shows a certificate error. All dates were checked against the CA/Browser Forum and Let's Encrypt on October 23, 2026.

What is changing, and when

The longest an SSL certificate can last drops from 200 days to 100 days on March 15, 2027, and to 47 days on March 15, 2029. These limits are set by the CA/Browser Forum, the group of certificate authorities and browser makers that writes the rules every public certificate must follow. It approved the schedule in Ballot SC-081v3, with voting closing on April 11, 2025.

The first step already happened. Since March 15, 2026, new certificates cannot be valid for more than 200 days. Before that, the limit was 398 days. The rule text in the Baseline Requirements, section 6.3.2, is plain: certificates issued "on or after 2027-03-15 and before 2029-03-15" must not have a validity period "greater than 100 days."

The free certificate authority Let's Encrypt is moving on its own timeline too. On October 7, 2026 it confirmed that "on February 10, 2027, all Let's Encrypt subscribers will move to certificates with 64 day lifetimes by default." Its current default is 90 days.

All dates were checked against the sources on October 23, 2026. We will update this page if the CA/Browser Forum or Let's Encrypt changes the schedule.

Why certificates are getting shorter

Shorter certificates limit the damage when something goes wrong. Let's Encrypt says it is making the move "because this reduces the risk of key compromise and mis-issuance." A stolen or wrongly issued certificate that lasts 47 days is a much smaller problem than one that lasts a year.

The rules also shorten how long a certificate authority can reuse its check that you control your domain. From March 15, 2027, that reuse period is 100 days, and from March 15, 2029, it is 10 days, per the Baseline Requirements. In practice, this means your domain will be checked more often, which is only painless if it is automated.

Who is affected

Every public website with HTTPS is affected, but most will not notice. If your host or platform issues and renews certificates automatically, the change happens in the background. The sites at risk are the ones where a person renews the certificate by hand, or where an old script renews it on a fixed schedule.

The paid yearly certificate problem

Many small businesses still buy a one-year certificate from a registrar and have someone install it each year. That model is already gone: since March 15, 2026, no new certificate can last a year. A provider can still sell you a one-year subscription, but the certificate inside it has to be replaced every 200 days now, and every 100 days from March 2027. If a person has to do that by hand, it will eventually be missed.

Why an expired certificate is worse than it used to be

When a certificate expires, browsers show a full-page security error and most visitors leave. Chrome also now asks users before it opens any public site without working HTTPS, a change Google confirmed for all users on October 21, 2026. Our guide to Chrome's HTTPS-by-default warning covers that change. Together they make a lapse in HTTPS more visible to visitors than it has ever been.

What to do before March 15, 2027

Automate certificate renewal end to end, then add a second check that tells you if it fails. That is the whole job. Here is how.

1. Find every certificate. Main domain, www, subdomains, shop, booking and API addresses, and any mail or VPN hostnames. Note who issued each one and when it expires.
2. Find out how each one renews. Automatic through your host, automatic through a script, or by hand. Anything renewed by hand is the priority.
3. Switch manual certificates to automatic. Most hosts offer free automated certificates. If you need a paid certificate for business reasons, ask your provider for automated (ACME) issuance.
4. Check your renewal timing. Let's Encrypt advises that if renewals "are hard-coded to a date from expiration you should update them to renew at approximately ⅔ of the lifetime instead." It suggests searching cron jobs and scripts for hard-coded numbers "like 83, 80 or 60."
5. Prefer clients that support ARI. ACME Renewal Information lets the certificate authority tell your client when to renew. Let's Encrypt says that with ARI "you should be all set."
6. Automate deployment, not just renewal. A renewed certificate that never reaches the server, CDN or load balancer still expires. Make sure the web server reloads after renewal.
7. Add an independent expiry alert. Let's Encrypt stopped sending expiry reminder emails on June 4, 2025. Use your host's monitoring or a separate certificate monitoring service so a failure is caught before visitors see it.
8. Test in staging if you run your own server. Let's Encrypt began issuing 64-day certificates in its staging environment on October 14, 2026, so you can test now.

What Let's Encrypt says will not change

Let's Encrypt says "rate limits will not be impacted by this change" and "we will not revoke valid certificates as a part of this process." Certificates already issued keep their original expiry date. The change applies to certificates issued or renewed on and after February 10, 2027.

Deadline checklist

• Now: list every hostname and certificate you own, with its issuer and expiry date.
• Now: confirm each one renews automatically. Flag anything renewed by a person.
• November 2026: move manual certificates to automated issuance.
• November 2026: if you run your own server, check your ACME client supports ARI or renews at two thirds of the lifetime.
• December 2026: test renewal against Let's Encrypt staging, where 64-day certificates are live.
• December 2026: set up an expiry alert that does not depend on the renewal system itself.
• By February 10, 2027: be ready for 64-day Let's Encrypt certificates.
• By March 15, 2027: be ready for the 100-day maximum from every certificate authority.
• Before March 15, 2029: plan for 47 days, by which point manual renewal is not realistic.

What this costs to fix

For most small business sites, the cost is near zero: the certificate is free from the host and renewal is already automatic. Where it is not, the work is a short configuration job, not a project. The cost of ignoring it is higher: an expired certificate on a contact or checkout page blocks every visitor until someone notices and fixes it.

If your site is on old hosting that cannot automate certificates, that is often a sign the whole setup is due for a review. Our guide to choosing web hosting covers what to look for. Ongoing certificate checks belong in a website maintenance plan; on our price sheet, maintenance is roughly 15 to 20% of the build cost per year, or a monthly plan. If you are weighing a rebuild, the free website cost calculator gives a planning range.

Next steps

Spend fifteen minutes this week listing your certificates and how they renew. If everything is automatic, you are ready. If not, you have until March 15, 2027 to fix it, and the sooner the better.

• Check the HTTPS side too, with our guide to Chrome's HTTP warning.
• Learn the basics in our HTTP vs HTTPS guide.
• Run through our 2026 website audit checklist for everything else that changed this year.
• Or contact us and we will check your certificates and quote any fix.