SSL Certificate Validity Falls to 47 Days. Who Renews Yours Before Customers See a Warning?

How long is an SSL certificate valid now, and how will it change?

The maximum validity of an SSL certificate is now 200 days, down from 398 days until March 15, 2026. On March 15, 2027 it falls to 100 days, and on March 15, 2029 to 47 days, under the Baseline Requirements that the CA/Browser Forum sets for every certificate authority in the world. Let's Encrypt, the largest issuer of free certificates, announced on October 7, 2026 that its certificates drop from 90 days to 64 days starting February 10, 2027. In practice, a certificate your company used to renew once a year now needs renewing at least twice, then four times, then about eight times. If renewal stays a task someone has to remember, one day a customer will open your website and see a warning that the connection is not secure.

The timeline: from 398 days to 47

The last column matters more than it looks. Domain validation is the step where you prove to the certificate authority that you control your domain, by adding a DNS record or placing a file on your server. Today one validation can be reused for 200 days; from March 2029 it is good for only 10 days, so almost every renewal will need a fresh validation. The Forum adopted this schedule on April 11, 2025, with 25 certificate authorities voting yes and none against, and all four voting browser makers in favour. It is not a proposal that might slip. It is a rule every certificate authority follows to keep its certificates trusted by browsers.

What changes for free Let's Encrypt certificates?

Many small and mid-sized websites run on free Let's Encrypt certificates, often without the owner knowing. According to its official announcement and published schedule:

• October 14, 2026: the staging environment starts issuing 64-day certificates, so you can test your systems before the real date.
• February 10, 2027: every certificate issued or renewed from this date is valid for 64 days, and the authorization reuse period drops from 30 days to 10 days.
• February 16, 2028: validity drops to 45 days, and a validation is good for only 7 hours.

Let's Encrypt warns about a common mistake: scripts and scheduled jobs written around a 90-day certificate, with fixed renewal points such as 83, 80 or 60 days. Those need changing. The recommendation is to renew at about two-thirds of the certificate's lifetime, roughly day 42 of 64. If your renewal client supports ACME Renewal Information (ARI), you need no change, because the certificate authority tells the client itself when to renew.

One more detail: Let's Encrypt stopped sending expiry reminder emails on June 4, 2025. If you were waiting for an email to remind you to renew, it will not arrive.

What happens to your business the day the certificate expires?

• Website and online store: the browser shows a full-page warning instead of your site, saying the connection is not private. Most visitors close the page and do not come back, and those who continue do so worried about entering their card.
• Mobile app: the app talks to your server over an encrypted connection and refuses to connect once the server's certificate expires. The user sees a generic error or a blank screen with no idea why.
• Integrations with other systems: payment notifications, shipping integrations and accounting systems all run over encrypted links. An expired certificate stops them silently, and you may only find out when a customer who paid complains that their order was never confirmed.
• Email and internal dashboards: mail servers, admin panels and staff tools have certificates too, and they are usually the most forgotten because nobody looks at them every day.

You bought a paid certificate for a full year. What changed?

Buying no longer equals installing. No certificate authority can issue you a certificate valid for more than 200 days today, so they keep selling an annual subscription and reissue the certificate within it. SSL.com, for example, says your purchase is still a 12-month license, that it now issues certificates valid for 198 days, and that reissuing within your term carries no extra charge. But every reissue means a new domain validation and a new installation on the server. From March 2027 that happens at least 4 times a year, and from March 2029 about 8 times. The question is no longer what the certificate costs. It is who installs it, how often, and who answers for it when it is forgotten.

A five-step plan for your company

1. Inventory every certificate: website, online store, mobile app server, email, admin panels and every subdomain. Record the issuer, the expiry date and the person responsible for each one.
2. Automate renewal: with a renewal client on the server, or with certificates your cloud provider or content delivery network manages and renews automatically. If your store runs on a hosted platform, ask it in writing: does it renew the certificate on its own, and who follows up if renewal fails?
3. Monitor expiry with an independent tool: do not assume the automation works. Monitoring services alert you days before expiry, and when it ended its reminder emails Let's Encrypt pointed to a free monitoring service covering up to 250 certificates.
4. Check old scripts: look for fixed numbers built around a 90-day certificate, and test renewal against the staging environment, which starts issuing 64-day certificates on October 14.
5. Name the owner in the contract: add a clear clause to your hosting or maintenance contract that certificate renewal and monitoring belong to the provider, with a set response time if a certificate expires.

How Origami helps

In the websites and apps we build at Origami, certificate renewal is automated from day one, and independent monitoring alerts us before anything expires, so nothing depends on someone's memory. If you already have a website or system, we inventory its certificates and move them to automatic renewal as part of the post-launch maintenance service we described in our article on maintenance and support after launch. See also cybersecurity essentials for small and mid-sized businesses.

Sources

• CA/Browser Forum: Baseline Requirements for TLS Server Certificates, section 6.3.2 (validity schedule) and section 4.2.1 (validation reuse periods)
• CA/Browser Forum: Ballot SC-081v3 results on the schedule for reducing validity periods, April 11, 2025
• Let's Encrypt: 64-day certificate lifetimes coming February 2027, October 7, 2026
• Let's Encrypt: from 90 to 45 days, the schedule through February 2028
• Let's Encrypt: ending expiration notification emails on June 4, 2025
• SSL.com: SSL certificate validity changes and what they mean for your annual plan