SSL Certificate Validity Changes (2026 - 2029)
Last updated
Note
Since March 15, 2026, newly issued Sectigo certificates are valid for a maximum of 200 days. The maximum drops to 100 days on March 15, 2027 and 47 days on March 15, 2029. A certificate keeps the validity it was issued with, so certificates issued before each date are not shortened.
Table of Contents
- Timeline
- If I buy before a deadline, do I get the longer validity?
- What do I need to do?
- Have more questions?
The CA/Browser Forum approved Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods in April 2025, establishing a phased reduction in the maximum allowed validity period for publicly trusted SSL certificates, from 398 days down to 47 days by March 2029. This change affects all certificate authorities, including Sectigo, the issuer of our paid SSL certificates. Sectigo has published a detailed write-up on the 200-day transition and how to prepare.
Let’s Encrypt certificates were not affected by the first phase, because they are already valid for 90 days. Let’s Encrypt has announced its own schedule to shorten its certificates to 45 days by 2028, ahead of the CA/Browser Forum deadline.
Timeline
Under Ballot SC081v3, the CA/Browser Forum adopted the following phased reduction:
| Effective date | Maximum certificate validity |
|---|---|
| March 15, 2026 | 200 days |
| March 15, 2027 | 100 days |
| March 15, 2029 | 47 days |
This applies to all publicly trusted SSL certificates issued on or after each date. Certificates issued before the relevant date keep their longer validity and remain valid until their original expiration.
Let’s Encrypt plans to reduce the validity of its default certificates in two steps:
| Effective date | Let’s Encrypt certificate validity |
|---|---|
| February 10, 2027 | 64 days |
| February 16, 2028 | 45 days |
If I buy before a deadline, do I get the longer validity?
Yes. At each phase, certificates issued before the deadline keep the longer maximum validity that was in effect when they were issued.
- Issued before March 15, 2027: Sectigo certificates can have up to 200 days validity.
- Issued from March 15, 2027 until March 15, 2029: Sectigo certificates can have up to 100 days validity.
- Issued on or after March 15, 2029: Sectigo certificates are limited to a maximum of 47 days validity.
Certificates issued before March 15, 2026 kept the previous validity of up to one year and remain valid until their expiration date.
If you want a longer validity period, buy your Sectigo certificate before the deadline that applies to the validity you want. After each deadline, any newly issued certificate is subject to the new, shorter maximum for that phase.
What do I need to do?
- Sectigo certificates: Plan to renew or buy a new certificate before the current one expires, to keep uninterrupted coverage. You will receive expiration notifications before your certificate expires. Each new certificate requires domain validation to be completed again.
- Let’s Encrypt certificates: Set up auto-renewal so DNSimple renews the certificate before it expires. Shorter validity means you will need to install the renewed certificate on your server more often.
For more detail on the validity rules and how they affect renewals, see Do you support multi-year SSL certificates? and SSL Certificates Frequently Asked Questions.
Have more questions?
If you have additional questions or need assistance, contact support.