SSL Certificate Validity Is Shrinking: The 200-Day, 100-Day and 47-Day Timeline

SSL Certificate Validity Is Shrinking: What the CA/Browser Forum Decided

In 2025 the CA/Browser Forum — the industry group of certificate authorities and browser makers that sets the rules for publicly trusted TLS certificates — adopted Ballot SC-081. The ballot shortens the maximum SSL/TLS certificate validity period in stages, replacing today's 398-day maximum with progressively shorter lifespans through 2029. If you buy, sell or manage SSL certificates, this is the biggest change to certificate lifecycles since validity was capped at 398 days back in 2020.

The change applies to every publicly trusted certificate, regardless of which certificate authority issues it or which validation level — DV, OV or EV — it uses. It does not apply to private or internal PKI certificates that aren't chained to a public root.

The New SSL Certificate Lifespan Timeline (2026–2029)

SC-081 rolls out in three steps, each cutting the maximum SSL certificate validity roughly in half:

These dates mark when each new maximum takes effect for newly issued certificates — a certificate issued the day before a cutover can keep its older, longer validity until it expires. Exact enforcement details can vary slightly by certificate authority, so it's worth checking your CA's own published schedule alongside the ballot text itself.

This continues a decade-long trend: browsers and certificate authorities have progressively cut maximum certificate validity from several years down to 398 days over the 2010s, and SC-081 simply extends that direction further. If your current certificate was issued before a given deadline, it keeps running under the rules that applied at issuance — there's no need to replace a still-valid certificate early just because a later cutover date has passed.

Why Are SSL Certificate Lifespans Getting Shorter?

Shorter validity is a deliberate trade-off, pushed mainly by browser vendors, in exchange for better security hygiene across the web:

• Security exposure window. If a private key or certificate is ever compromised, a shorter validity period limits how long an attacker can use it before it naturally expires.
• Revocation is unreliable. Certificate revocation checking (CRL and OCSP) has long been inconsistent, and many browsers don't hard-fail when a revocation check itself fails. A short validity period acts as a backstop: even a certificate that's never explicitly revoked stops working on its own within weeks rather than months.
• Crypto agility. Shorter-lived certificates make it realistic to roll out new algorithms, key sizes or post-quantum-ready standards across the web within months, instead of waiting years for long-lived certificates to age out on their own.

Together, these three reasons are why every major browser vendor backed Ballot SC-081, even though parts of the certificate authority industry raised concerns about the operational burden of far more frequent reissuance for their customers.

Domain Validation (DCV) Will Need to Happen More Often, Too

Validity isn't the only thing shrinking. The CA/Browser Forum is also cutting how long a certificate authority can reuse a previous domain validation (DCV) result before requiring you to re-prove control of the domain — down to as little as 10 days by 2029 under the same ballot's schedule.

In practice, the era of "prove you own example.com once, then renew for years without touching DNS again" is ending. Whichever DCV method you use — a DNS CNAME/TXT record, an HTTP file, or email — you'll need a reliable way to repeat it on every renewal cycle. DNS-based validation tends to be the easiest to automate, since a CNAME or TXT record can usually be created once and left in place.

Shorter reuse windows also close a real gap: if control of a domain changes hands between an original validation and a later renewal that simply reused it, an old DCV result could otherwise let a certificate keep being issued to the wrong party. Requiring fresher proof of control on a shorter cycle reduces that window.

What Shorter Validity Means for Website Owners

For a typical website owner, the practical impact is simple: your certificate will need renewing noticeably more often. A 398-day certificate you used to think about once a year becomes a 200-day certificate today, a 100-day certificate from 2027, and eventually a 47-day certificate — renewed roughly every six to seven weeks — by 2029.

Browsers and visitors don't see or care whether you bought "one year" or "three years" of SSL; they only check whether the certificate currently installed on your server is valid right now. An expired certificate triggers the same browser warning no matter how the underlying subscription was sold, so a missed renewal — not the calendar length of the certificate — is the real risk to plan around.

If you manage several domains, consolidating coverage — for example onto fewer certificates using Wildcard or Multi-Domain SAN coverage — won't change how often each certificate needs renewing, but it does reduce the number of separate renewal events you have to track.

What It Means for Hosting Providers and SSL Resellers

Hosting providers, agencies and SSL resellers feel this change multiplied across every domain they manage. Reissuing and reinstalling a certificate twice a year is manageable for one site; doing it for hundreds of customer domains without automation quickly turns into a support burden.

It also changes how "multi-year SSL" should be sold and explained. A multi-year certificate is no longer one certificate that sits untouched for two or three years — it's a subscription in which the certificate itself is reissued, and increasingly re-validated, on a shorter cycle behind the scenes, while the customer still pays once for the term. Providers who explain this clearly, and who invest in automated reissuance and DCV, turn a shorter validity period into a retention advantage instead of a support headache. We cover this workflow in more detail for hosting providers in our guide to selling SSL as a hosting provider.

It's also a good moment to revisit which certificate authorities and products you standardize on: how automation-friendly a provider is — API support, DNS-based DCV, and clear status and expiry data — now matters as much as price.

How to Prepare: Automate Certificate Management

Whether you manage five certificates or five thousand, the fix for a shorter validity cycle is the same: stop treating renewal as a manual, once-a-year task.

• Build an inventory. List every domain, its certificate authority, and its issue and expiry dates, plus who is responsible for it. You can't automate what you haven't mapped.
• Automate issuance and renewal. Use the ACME protocol — the same automated validation and issuance protocol Let's Encrypt popularized with its free, short-lived DV certificates — or a REST API to request, validate and reissue certificates without a human clicking through a browser each time. SSLCipher's API, for example, lets you list products and prices, create orders, track certificate status and download issued certificates programmatically; see the API documentation for the available endpoints.
• Automate domain validation too. Prefer DNS-based DCV where possible, since a CNAME or TXT record can be left in place and reused automatically on each renewal, instead of repeating a manual file upload or email confirmation.
• Monitor and get reminded. Set expiry alerts well before the new, shorter deadlines — a 47-day certificate leaves very little room for a missed reminder.

Get Ahead of the Shorter SSL Certificate Lifecycle

SSL certificate validity is only heading in one direction — shorter — through at least 2029, and domain validation will need to happen more often alongside it. Providers, agencies and site owners who move to automated issuance, renewal and DCV now will barely notice the transition; the ones who don't will be renewing certificates manually, more and more often, for the rest of the decade.

SSLCipher offers around 64 SSL products — DV, OV, EV, Wildcard and Multi-Domain, plus code signing and S/MIME — from Sectigo, GeoTrust, GlobalSign, Thawte, Certum and sslTrus, with public reseller pricing and an API built for exactly this kind of automation. If you manage certificates for clients or your own infrastructure, our SSL reseller program is a practical way to get ahead of the shorter renewal cycle.

Frequently asked questions