How long do SSL certificates actually last in 2026?
As of March 15, 2026, the maximum lifetime for a publicly trusted TLS certificate is 200 days — down from 398 days a few years ago. That ceiling drops to 100 days in March 2027 and 47 days in March 2029, under a rule the CA/Browser Forum approved unanimously in April 2025. Let’s Encrypt already issues certificates as short as six days.
No signup. Real results in about four seconds.
The timeline
Ballot SC-081v3, approved 29 votes to 0 — including Apple, Google, Mozilla and Microsoft — sets a maximum lifetime for every publicly trusted certificate, not just automated ones.
March 2026
200 days maximum — already in effect
March 2027
100 days maximum — scheduled
March 2029
47 days maximum — scheduled
Why lifetimes keep shrinking
A shorter certificate means a shorter window: if a private key leaks or a domain validation gets compromised, the damage is capped by how long the certificate stays trusted. Ninety days already limits that exposure far more than the year-long certificates common a decade ago; 47 days limits it further still.
The other effect is deliberate: a lifetime short enough makes manual renewal impractical, which pushes the entire ecosystem toward automated issuance. Let’s Encrypt is already ahead of the mandate — it began issuing six-day certificates in January 2026 and plans to make 45 days the standard lifetime by 2028.
What this breaks: counting down days
A monitoring ladder built around “warn at 60, 30, 14, 7 and 1 day” assumes certificates live long enough to spend most of their life far from expiry. At 90 days, the 60-day rung already fires a third of the way through a certificate’s life — while it’s completely healthy. At 47 days, every rung on that ladder fires immediately, forever.
The question worth monitoring isn’t “how many days are left” — a healthy short-lived certificate is always close to expiry. It’s “did the renewal that was supposed to happen actually happen?” That’s the model Lapsewatch’s certificate monitoring is built around: tracking the renewal cycle instead of the calendar, and asking the certificate authority directly over ARI where it’s supported.
Certificate lifetimes, answered
What is the maximum SSL/TLS certificate lifetime right now?
200 days, in effect since March 15, 2026, for every publicly trusted certificate — not just ones issued through automated ACME clients. That maximum drops to 100 days in March 2027 and 47 days in March 2029.
Does this apply to certificates I buy manually, or only free ones?
It applies to all publicly trusted certificates, manual or automated. A certificate bought from a traditional CA is bound by the same ceiling as one issued by Let’s Encrypt — the schedule just sets the maximum any CA is allowed to issue.
Will my existing longer certificate suddenly get cut short?
No — a certificate already issued keeps the lifetime it was issued with. The new maximum only applies to certificates issued after each deadline takes effect, so the change shows up gradually as certificates come up for renewal.
Stop counting days on certificates that are always close to expiry
Five domains free, forever, no card.
Start free