SSL Certificate Validity Is Shrinking To 47 Days: What Changes And When

Introduction

You bought a one-year certificate for the website, put a reminder in the calendar and forgot about it. That worked for years. It stops working now. A certificate issued today can be valid for at most 200 days, and by 2029 the limit is 47 days, which means a renewal roughly every month for every hostname you look after by hand: the website, the link tracking host, the MTA-STS policy host and any mail server you run yourself.

The maximum SSL certificate validity is set by the CA/Browser Forum's Baseline Requirements, the rules every publicly trusted CA follows. Ballot SC081, adopted in April 2025, cut the limit from 398 days in three steps: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Each step applies to certificates issued on or after that date.

The SSL Certificate Validity Timeline

The Baseline Requirements cut two numbers at once: how long a certificate lasts, and how long a CA may reuse a past check that you control the domain before it has to check again. Both come from section 6.3.2 and section 4.2.1:

Two details are easy to miss. The limits are hard caps, and the rules also say a certificate should stay one day under each (397, 199, 99 and 46 days). And the reuse period for your organisation's identity, which only matters for OV and EV certificates, stays at 398 days. The steep drop is in domain validation: from 2029, a CA can rely on a domain check for only 10 days.

Let's Encrypt Moves Earlier, To 45 Days

Let's Encrypt already issues 90-day certificates, so the 2026 and 2027 steps do not touch it. It is moving ahead of the 2029 limit on its own schedule, published in From 90 To 45: an opt-in tlsserver profile issues 45-day certificates from 13 May 2026; the default profile moves to 64-day certificates with 10-day authorization reuse on 10 February 2027, and to 45-day certificates with 7-hour reuse on 16 February 2028. Its advice is blunt: renewing on a fixed 60-day timer will no longer be enough.

Why Certificate Lifetimes Are Shrinking

A certificate is a statement that, when it was issued, the holder controlled the name. The longer it lasts, the longer that statement can be out of date: the domain changed hands, the key leaked, the CA made an error. Revocation was meant to cover that gap, and in practice it does not work well, which is why the industry stopped relying on it. Ballot SC063 made OCSP optional for public CAs from March 2024, and Let's Encrypt switched its OCSP service off in August 2025. A short lifetime is the fallback that always works: a bad certificate simply expires soon.

The 10-day domain validation reuse in 2029 follows the same logic. It means that, in practice, a CA confirms you control the domain at almost every issuance. Automation that proved control once and then reused it for a year will have to prove it every time.

What Breaks For Email Senders

Shorter SSL certificate validity changes very little for a website whose host renews certificates for you. The risk sits in the hostnames nobody thinks of as a website. For a team that sends email, these are the usual ones:

• The link tracking host. If your links are rewritten through a hostname on your domain, its certificate must cover that exact name. When it expires, every https:// link in every email you have sent opens with a browser warning, including old emails sitting in inboxes.
• The MTA-STS policy host. RFC 8461 requires the policy at https://mta-sts. plus your domain to be served with a valid certificate. If it expires, senders cannot fetch a new policy.
• A mail server you run yourself. The MX certificate is usually loaded from a different file than the web server's, so a renewed web certificate does not mean a renewed mail certificate. Senders that enforce MTA-STS refuse delivery to an MX host with an expired certificate.
• Webhook and API endpoints. Integrations that post replies or events to your server fail as soon as the certificate expires, often without anyone looking at the logs.

Each of these is a separate certificate with its own expiry date. On a manual process, that is four reminders, each about to arrive far more often.

How Often You Will Renew

Let's Encrypt's integration guide recommends renewing when a third of a certificate's lifetime is left, which leaves room for a failed renewal to be retried. Applied to each SSL certificate validity limit, that gives the following, per hostname:

Twelve manual renewals a year for each of four hostnames is not a process anyone keeps up, which is the point of the change.

How To Prepare For 47-Day Certificates

1. List every hostname with a certificate. Website, www, the tracking host, mta-sts, each MX host, webhook endpoints. A certificate's list of names often reveals ones you forgot.
2. Note who renews each one. Your host, your CDN, a provider behind a CNAME, or you. Only the last group needs work.
3. Move every manual one to ACME. Use a client that renews on its own, ideally one that supports ACME Renewal Information (ARI), which lets the CA tell the client when to renew. Let's Encrypt recommends it.
4. Make domain validation repeatable. With 10-day reuse, the DNS-01 or HTTP-01 challenge must succeed unattended every time. For DNS-01, a CNAME from _acme-challenge to a zone your client can update keeps API keys for your main zone off the server.
5. Reload what reads the file. A mail server that loaded the old certificate at start-up keeps serving it until it is reloaded. Add the reload to the renewal hook.
6. Check from outside, on a schedule. Renewal logs say a file was written, not that the server is presenting it.

If you also publish a CAA record, make sure it names the CA your ACME client uses, or issuance will fail at exactly the moment the old certificate expires.

SSL Certificate Validity Questions

What Is The Maximum SSL Certificate Validity In 2026?

200 days for a publicly trusted certificate issued on or after 15 March 2026, under the CA/Browser Forum Baseline Requirements. Certificates issued before that date could last up to 398 days and remain valid until they expire, so you will still see some longer ones in 2026 and early 2027.

When Do SSL Certificates Become 47 Days?

On 15 March 2029. Certificates issued from that date can be valid for at most 47 days, and a CA can reuse a domain validation for only 10 days. Before then, the limit is 100 days for certificates issued from 15 March 2027. Let's Encrypt plans to reach 45 days earlier, in February 2028.

Do The Limits Apply To Internal Certificates?

No. The Baseline Requirements govern publicly trusted TLS server certificates, the kind browsers and mail servers trust by default. A private CA you run for internal services sets its own rules. Anything reachable from the internet by clients you do not control, including your MX hosts and tracking host, needs a public certificate and follows the limits.

Does Paying For A Longer Certificate Still Work?

Some CAs sell multi-year subscriptions, but each certificate they issue under one still obeys the SSL certificate validity limit for its issue date. You are buying the right to reissue, not a longer certificate, so the server still needs a new certificate installed before each one expires.

How Eklow Handles This

The free SSL certificate checker reads the certificate a server actually presents and shows its expiry date, the days left and a renew-by date set at a third of its lifetime. It compares the lifetime with the CA/Browser Forum limit that applied on the day the certificate was issued, so a 200-day certificate issued in April 2026 passes and one that breaks the rule is flagged.

Run it against each hostname on your list: Website for the site and webhook endpoints, Tracking Domain for a link host, which also shows where its CNAME points and whether http:// links redirect, and Mail Domain for your MX hosts. Mail Domain mode also fetches your MTA-STS policy the way a sending server does, so an expired certificate on the policy host is reported as a policy senders cannot use.

Inside Eklow, campaigns send through the mailboxes you connect. For Google and Microsoft 365 mailboxes, the mail server certificates belong to the provider and renew without you. For a custom SMTP mailbox, Eklow makes a real TLS connection and login before saving it, so a server whose certificate has lapsed is caught at connect. The domain verification guide covers the DNS records a sending domain needs alongside this.