Shorter SSL Certificates: What Changes in 2026 and 2027 and How to Keep Your Site Free of Security Warnings

What changed and what is the timeline?

In April 2025 the CA/Browser Forum approved ballot SC-081v3, proposed by Apple, with 25 certificate authorities voting in favor (none against and five abstentions), along with Apple, Google, Microsoft and Mozilla (CA/Browser Forum, DigiCert). The ballot sets two reductions: the maximum certificate lifetime, and how long the authority can reuse its check that you control the domain.

Source: CA/Browser Forum Baseline Requirements, sections 4.2.1 and 6.3.2 (version 2.3.1, October 4, 2026).

The changes apply to new certificates. One issued before each date stays valid until it expires.

Is it 200 days or 199?

The official limit is 200 days. The requirements say that a certificate issued between March 15, 2026 and March 15, 2027 must not exceed 200 days, and recommend not going past 199 (CA/Browser Forum). The same applies afterwards: 100 and 99 days, 47 and 46 days.

That’s why several authorities issue one day less. DigiCert, for example, issues certificates of 199 days at most and notes that its limit is one day shorter than allowed (DigiCert). If you see “199 days” on your provider’s website, it’s the same rule applied with a margin.

Who is affected?

Anyone with a website, an online store or a service running on HTTPS. The impact depends on how the certificate is renewed today:

• Manual renewals. If someone downloads the certificate, installs it and sets a calendar reminder, that job goes from once a year to almost twice a year now, and to about four times a year from March 2027.
• Multi-year purchases. You can still pay for multi-year coverage, but the installed certificate has to be reissued each time it reaches the limit. DigiCert, for example, lets you reissue at no extra cost for as long as the plan lasts (DigiCert). Someone has to do that reissue and install it.
• Certificates installed by hand on servers and devices. Mail servers, admin panels, VPNs, load balancers, cameras, NAS devices or internal apps exposed to the internet. They are often left out of automatic renewal.
• Organization-validated certificates (OV and EV). Besides the lifetime, the period for reusing organization details also gets shorter, going from 825 to 398 days from March 2026 (CA/Browser Forum).

Private certificates that a company issues for internal use are not affected, because browsers don’t publicly trust them. Neither are Cloudflare origin certificates, which only encrypt the connection between Cloudflare and your server (Cloudflare).

What about Let’s Encrypt?

Let’s Encrypt, the free certificate authority that many hosting companies use, issues 90-day certificates and has its own timeline for going down to 45 (Let’s Encrypt):

• February 10, 2027: the default profile moves to 64 days and domain validation can be reused for 10 days.
• February 16, 2028: the default profile moves to 45 days and validation reuse drops to 7 hours.

Let’s Encrypt recommends not renewing by hand, using a client that supports ARI (a mechanism through which the authority tells the client when to renew) and setting up alerts for certificates that aren’t renewed in time.

What does a visitor see if the certificate expires?

Chrome shows a full-page warning reading “Your connection is not private” with a code such as NET::ERR_CERT_DATE_INVALID, which points to a date problem (Google).

The “Not secure” label in the address bar appears when the site doesn’t use a private connection, meaning it loads without HTTPS (Google).

How do I automate renewal?

1. Use a certificate with automatic renewal from your hosting. Many hosting control panels install and renew free certificates with no manual steps. Check that it’s turned on for the main domain, for the “www” version and for each subdomain.
2. If you manage the server, use ACME. It’s the standard protocol for requesting and renewing certificates automatically (IETF, RFC 8555). Clients such as Certbot or acme.sh do it with a scheduled task. Let’s Encrypt, DigiCert and other authorities support it (DigiCert).
3. If your domain runs through Cloudflare, its Universal SSL certificate is issued, renewed and installed automatically on every plan, including the free one (Cloudflare). The origin server still needs its own certificate.
4. Monitor expiration dates. An alert that gives you two or three weeks’ notice leaves time to fix a renewal that failed.

Checklist

• An inventory of every domain and subdomain using HTTPS, including email, admin panels and exposed internal services.
• For each one: who issues the certificate, when it expires and whether it renews on its own.
• Automatic renewal turned on in your hosting or through an ACME client.
• Certificates bought for several years: who reissues them and on what date.
• Automated DNS domain validation if you use wildcard certificates (*.yourdomain.com).
• Expiration alerts sent to an inbox someone actually reads.
• A plan for March 2027, when the limit drops to 100 days.

What we offer at AiDo Creative

In our hosting and website maintenance plans we review the certificates on your domains, set up automatic renewal wherever possible and put together a calendar for the ones that have to be installed by hand. We do the same for servers and devices as part of IT support. You can find the details on our Hosting page.

Frequently asked questions