From 15 March 2027, no public certificate authority may issue a TLS certificate valid for more than 100 days. Today's limit is 200 days. For anything renewed by hand, that means going from about two renewals a year to five or six.
It's the second of three steps the CA/Browser Forum approved in 2025; the full timeline down to 47 days in 2029 is in 47-day SSL certificates. This page is about getting ready for the step that's next.
What changes on 15 March 2027
| Until 14 March 2027 | From 15 March 2027 | |
|---|---|---|
| Maximum certificate lifetime | 200 days | 100 days |
| Domain validation can be reused for | 200 days | 100 days |
| Organisation details (OV/EV) can be reused for | 398 days | 398 days |
Certificates issued before the date keep their lifetime, so a 200-day certificate bought in early March 2027 still runs into the autumn. After that, every renewal is a 100-day one.
What it means in practice
Renewing at about two-thirds of the lifetime, which is what ACME clients do, means a renewal roughly every 66 days: five or six a year per certificate. For a certificate installed by hand on a firewall, a load balancer and a Remote Desktop gateway, that's 15 to 18 manual installs a year instead of six.
Domain validation drops to 100 days too, so the CA has to re-check that you control the domain more often. With email-based validation, that's more approval emails to someone's inbox; DNS or HTTP validation through an ACME client handles it without anyone noticing.
Checklist: before March 2027
- List every certificate you have. Start from the Certificate Transparency logs, which hold every public certificate ever issued for your domain, rather than from memory. The certificate finder does this in seconds.
- Sort them into automated and manual. Web servers, CDNs and cloud load balancers usually renew themselves already. Firewalls, VPN appliances, Windows services and anything with an "upload certificate" button usually don't.
- Automate the manual ones where you can:
- Linux web servers: Certbot.
- Windows and IIS: win-acme.
- Appliances: many firewalls now have built-in ACME support or an API; see the runbooks for FortiGate, SonicWall and Sophos Firewall.
- Write a runbook for what stays manual: who owns it, where the certificate goes, how to test it. Five times a year is too often to rely on memory.
- Switch validation to DNS or HTTP if your CA still emails someone for approval.
- Make sure renewals are actually installed. The most common failure with frequent renewals isn't a missed renewal but a certificate renewed on disk and never loaded by the server. See certificate renewed but not installed.
- Turn off "30 days left" alerts that were tuned for year-long certificates. At 100 days they fire constantly, and people learn to ignore them.
Let's Encrypt users
Let's Encrypt's certificates already last 90 days, so they're inside the new limit. It has its own schedule: 64-day certificates from 10 February 2027 and 45 days from 16 February 2028. If Certbot or another ACME client renews automatically, there's nothing to do.
Check your domain
The SSL expiry checker shows every hostname's certificate, when it expires and whether a renewal was issued but never installed. Nameward's monitoring alerts relative to each certificate's lifetime, so short certificates don't drown you in warnings.