TL;DR: A public TLS (SSL) certificate issued since March 15, 2026 can be valid for at most 200 days, down from 398, under the CA/Browser Forum Baseline Requirements. The next cut, to 100 days, takes effect March 15, 2027, and the limit reaches 47 days on March 15, 2029. A certificate that used to be replaced once a year will need replacing about eight times a year by 2029, and any one that slips through takes a website, portal, or payment page offline behind a browser security warning. The fix is automated certificate discovery and renewal, not more calendar reminders.
Updated October 23, 2026: re-verified against the current Baseline Requirements. The 100-day step is now under five months away, and Let's Encrypt has published its own schedule for moving its default certificates to 64 days in February 2027.
Key takeaway: Manual certificate renewal is a scheduled outage waiting to happen. With the maximum lifetime falling to 100 days in March 2027 and 47 days in 2029, small businesses need certificates that renew themselves, with monitoring as a backstop.
Worried an expired certificate could take your site down? Preferred Data Corporation was founded in 1987 and is headquartered in High Point, NC. Call (336) 886-3282 or request a certificate and infrastructure review.
What changed with TLS certificate lifetimes in 2026?
The maximum public TLS certificate lifetime fell from 398 days to 200 days on March 15, 2026, and it keeps shrinking on a fixed schedule. The change came from CA/Browser Forum Ballot SC-081v3, which passed in April 2025 with all four browser and platform members, Apple, Google, Microsoft, and Mozilla, voting yes.
| Effective date | Max TLS certificate lifetime | Domain validation reuse |
|---|---|---|
| Before Mar 15, 2026 | 398 days | 398 days |
| March 15, 2026 | 200 days | 200 days |
| March 15, 2027 | 100 days | 100 days |
| March 15, 2029 | 47 days | 10 days |
Per DigiCert's summary of the ballot, the reuse period for validated business identity information, the company name and details in an organization-validated (OV) or extended-validation (EV) certificate, also dropped from 825 days to 398 days on March 15, 2026. That means more frequent re-verification of your business details for those certificate types. Domain-validated (DV) certificates carry no business identity information, so that part does not affect them.
Why are certificate lifetimes getting shorter?
Shorter certificates reduce how long a stolen key or a mis-issued certificate stays useful, and they push the web toward automation. If a certificate or its private key is compromised, a 47-day certificate limits the damage far more than a 398-day one. Shorter domain-validation reuse also means a CA has to re-check that you still control a domain more often.
The tradeoff is operational load. As SSL.com notes about the 200-day limit, "You'll renew certificates twice as often." At 47 days, the arithmetic is roughly eight replacements a year per certificate.
What are certificate authorities doing about it?
The largest free certificate authority has already set its own dates. Let's Encrypt announced that its default certificates move from 90 days to 64 days on February 10, 2027 and to 45 days on February 16, 2028. Its opt-in tlsserver profile, which Let's Encrypt scheduled to switch to 45-day certificates on May 13, 2026, now lists a validity period of 45 days. Let's Encrypt also stopped sending expiration reminder emails on June 4, 2025, so a business that relied on those emails no longer gets them. Let's Encrypt notes that all publicly trusted certificate authorities will be making similar changes.
How does an expired certificate hurt a small business?
An expired TLS certificate causes an immediate, visible outage: browsers show a full-page security warning, and other systems refuse the connection. The impact lands in several places at once:
- Lost customers: Visitors see a security warning instead of your site and leave.
- Broken integrations: APIs, payment pages, and partner connections that check certificates stop working until the certificate is replaced.
- Lost trust: A security warning on your own domain makes customers wonder whether you were hacked.
- Emergency work: Without automation, the fix is a rushed manual reissue while orders and logins are down.
These outages are preventable. They usually happen because nobody owned the renewal, not because the technology failed.
What should small businesses do before the March 2027 deadline?
Automate certificate discovery, renewal, and deployment so no certificate depends on a person remembering a date. A practical plan:
| Step | Action | Who owns it |
|---|---|---|
| 1 | Inventory every certificate across your sites, apps, devices, and vendors | IT + managed partner |
| 2 | Record owners and expiry dates, including "forgotten" internal systems | IT + managed partner |
| 3 | Automate renewal with ACME or your certificate authority's automation | Managed IT partner |
| 4 | Add expiry monitoring and alerts as a backstop to automation | Managed security partner |
| 5 | Remove hard-coded renewal intervals that assume a 90-day or one-year life | IT + managed partner |
| 6 | Plan for more frequent business re-verification on OV/EV certificates | Leadership + IT |
The goal is a system where certificates renew themselves and a person is alerted only when something fails. For businesses without a full-time IT team, this is the kind of behind-the-scenes work a managed IT partner can own.
Get certificate renewals off your plate
Automated certificate management vs. manual tracking
| Factor | Automated lifecycle management | Manual calendar tracking |
|---|---|---|
| Effort at a 47-day lifetime | System-driven | About eight replacements a year per certificate |
| Outage risk from a missed renewal | Low, with monitoring as a backstop | High: one missed date means downtime |
| Visibility into all certificates | Full inventory | Often incomplete |
| Staff time consumed | Minimal | Grows with every step down |
| Holds up as lifetimes shrink | Yes | No |
As lifetimes shrink toward 47 days, manual tracking does not just get harder, it stops working.
How does this connect to your broader IT and security posture?
Certificate management is one slice of the infrastructure hygiene that keeps a business online and trusted. The same discipline, knowing what you own, automating the routine, and monitoring for exceptions, applies to patching, backups, and network infrastructure. It also applies to device-level certificates such as the ones covered in our Windows Secure Boot certificate guide.
How does Preferred Data Corporation help?
We can take certificate lifecycle management off your team's plate as part of our managed IT, network, and cybersecurity services. That starts with an inventory of the public and internal certificates across your websites, applications, network devices, and third-party services, then automated renewal where your platforms support it, and expiry monitoring on top. Preferred Data Corporation is headquartered in High Point, NC, provides on-site service within 200 miles of High Point, and supports clients remotely across the US. Founded in 1987, we focus on manufacturing, construction, and industrial businesses.
Frequently Asked Questions
What is the maximum TLS certificate lifetime in 2026?
Since March 15, 2026, the maximum lifetime of a public TLS certificate is 200 days, down from 398 days. Under the CA/Browser Forum Baseline Requirements, it drops to 100 days on March 15, 2027, and to 47 days on March 15, 2029.
When do 100-day certificates start?
The 100-day maximum applies to certificates issued on or after March 15, 2027. Certificates issued before that date keep the validity they were issued with, up to the limit in force when issued (398 days before March 15, 2026; 200 days after).
Why did the CA/Browser Forum shorten certificate lifetimes?
Shorter lifetimes reduce how long a compromised or mis-issued certificate can be abused and force more frequent re-validation of domain control and business identity. The ballot passed in April 2025 with Apple, Google, Microsoft, and Mozilla all voting in favor.
What happens if my SSL certificate expires?
Browsers show a security warning that blocks visitors, and connected systems such as APIs and payment pages that check certificates stop working. The outage lasts until a new certificate is issued and installed.
Will Let's Encrypt certificates get shorter too?
Yes. Let's Encrypt plans to move its default certificates from 90 days to 64 days on February 10, 2027, and to 45 days on February 16, 2028. Let's Encrypt warns that renewing at a hard-coded interval of 60 days will no longer be sufficient, and recommends ACME clients that support ACME Renewal Information (ARI).
Do small businesses really need certificate automation?
Yes. At a 47-day maximum, each certificate needs replacing about eight times a year, and Let's Encrypt no longer sends expiration reminder emails. Automated renewal with monitoring is the reliable way to avoid expired-certificate outages.
Related Resources
- Windows Secure Boot certificate expiration guide
- Cloud vs. on-premises cost comparison
- Managed IT services
- Network infrastructure services
- Managed cybersecurity services
About the author: Preferred Data Corporation, founded in 1987, provides managed IT, AI transformation, and cybersecurity services. Headquartered at 1208 Eastchester Drive, Suite 131, High Point, NC 27265, we provide on-site service within 200 miles of High Point, including the Piedmont Triad, Charlotte, and Raleigh, and support clients remotely across the US. Call (336) 886-3282 or request a certificate and infrastructure review.