Skip to content

Shortening of TLS Certificate Validity

Following a decision by the CA/Browser Forum—an organization comprising web browser vendors and certificate authorities—the maximum validity period for publicly trusted SSL/TLS certificates is being progressively reduced. As of March 15, 2026, this limit will be 200 days. It will be further reduced to 100 days starting March 15, 2027, and to 47 days from March 15, 2029. This represents the maximum permitted duration; individual certificate authorities may choose to issue certificates for shorter periods.

For certificates that we manage on your behalf, we will handle these validity period adjustments internally. The processes for issuance, renewal, and deployment will continue as they do today.

What is changing and why

  • Starting March 15, 2026, newly issued publicly trusted SSL/TLS certificates (DV/OV/EV) may have a maximum validity period of 200 days. The previous maximum was 398 days.
  • From March 15, 2027, the maximum validity for newly issued certificates will be reduced to 100 days, and from March 15, 2029, it will be reduced to 47 days.
  • The reason for this change is enhanced security: shorter validity periods limit the window of opportunity for the misuse of compromised or erroneously issued certificates and accelerate the adoption of new security standards.

The result is that certificates will need to be renewed more frequently, but the environment will be more secure in the long term.

What this means for you

  • For certificates that we manage, we handle the current 200-day limit internally, without affecting your day-to-day operations. We continue to deploy and renew certificates just as we always have.
  • For Let’s Encrypt certificates, we already utilize automated issuance and renewal within supported configurations.
  • We are also monitoring the development of a new domain validation method called DNS-PERSIST-01, which aims to simplify certificate re-issuance and renewal by using a persistent validation record in the DNS. Its specification is still evolving and has not yet been published as a final RFC; therefore, we cannot currently provide a timeline for its potential implementation in our services.
  • For commercial (paid) certificates, we are expanding our automation capabilities to ensure timely renewal and seamless deployment, even with shorter validity periods.

Steps we are taking

  • We are tracking the CA/Browser Forum schedule and changes implemented by individual Certificate Authorities, adjusting our processes accordingly.
  • We are expanding certificate management automation to minimize the need for manual intervention during domain validation, issuance, renewal, and deployment.
  • If changes to a specific service require your cooperation, we will notify you in advance.

Our goal is to ensure the timely renewal and reliable deployment of certificates while requiring as little effort from you as possible.