# 100-day SSL certificates from March 2027: what to do before then

From **15 March 2027**, no public certificate authority may issue a TLS
certificate valid for more than **100 days**. Today's limit is 200 days. For
anything renewed by hand, that means going from about two renewals a year to
five or six.

It's the second of three steps the CA/Browser Forum approved in 2025; the
full timeline down to 47 days in 2029 is in
[47-day SSL certificates](/guides/47-day-ssl-certificates). This page is about
getting ready for the step that's next.

## What changes on 15 March 2027

| | Until 14 March 2027 | From 15 March 2027 |
|---|---|---|
| Maximum certificate lifetime | 200 days | **100 days** |
| Domain validation can be reused for | 200 days | **100 days** |
| Organisation details (OV/EV) can be reused for | 398 days | 398 days |

Certificates issued before the date keep their lifetime, so a 200-day
certificate bought in early March 2027 still runs into the autumn. After
that, every renewal is a 100-day one.

## What it means in practice

Renewing at about two-thirds of the lifetime, which is what ACME clients do,
means a renewal roughly **every 66 days**: five or six a year per
certificate. For a certificate installed by hand on a firewall, a load
balancer and a Remote Desktop gateway, that's 15 to 18 manual installs a year
instead of six.

Domain validation drops to 100 days too, so the CA has to re-check that you
control the domain more often. With email-based validation, that's more
approval emails to someone's inbox; DNS or HTTP validation through an ACME
client handles it without anyone noticing.

## Checklist: before March 2027

1. **List every certificate you have.** Start from the Certificate
   Transparency logs, which hold every public certificate ever issued for
   your domain, rather than from memory. The
   [certificate finder](/tools/find-ssl-certificates) does this in seconds.
2. **Sort them into automated and manual.** Web servers, CDNs and cloud load
   balancers usually renew themselves already. Firewalls, VPN appliances,
   Windows services and anything with an "upload certificate" button usually
   don't.
3. **Automate the manual ones where you can:**
   - Linux web servers: [Certbot](/guides/free-ssl-certificate-lets-encrypt).
   - Windows and IIS: [win-acme](/guides/lets-encrypt-iis-win-acme).
   - Appliances: many firewalls now have built-in ACME support or an API;
     see the runbooks for [FortiGate](/guides/fortigate-replace-ssl-certificate),
     [SonicWall](/guides/sonicwall-replace-ssl-certificate) and
     [Sophos Firewall](/guides/sophos-firewall-replace-certificate).
4. **Write a runbook for what stays manual**: who owns it, where the
   certificate goes, how to test it. Five times a year is too often to rely
   on memory.
5. **Switch validation to DNS or HTTP** if your CA still emails someone for
   approval.
6. **Make sure renewals are actually installed.** The most common failure
   with frequent renewals isn't a missed renewal but a certificate renewed on
   disk and never loaded by the server. See
   [certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).
7. **Turn off "30 days left" alerts** that were tuned for year-long
   certificates. At 100 days they fire constantly, and people learn to
   ignore them.

## Let's Encrypt users

Let's Encrypt's certificates already last 90 days, so they're inside the new
limit. It has its own schedule: 64-day certificates from 10 February 2027
and 45 days from 16 February 2028. If Certbot or another ACME client renews
automatically, there's nothing to do.

## Check your domain

The [SSL expiry checker](/tools/ssl-expiry-checker) shows every hostname's
certificate, when it expires and whether a renewal was issued but never
installed. Nameward's monitoring alerts relative to each certificate's
lifetime, so short certificates don't drown you in warnings.

## Sources

- [CA/Browser Forum: Ballot SC-081v3, schedule of reducing validity and data reuse periods](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/)
- [CA/Browser Forum: TLS Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/)
- [Let's Encrypt: decreasing certificate lifetimes to 45 days](https://letsencrypt.org/2025/12/03/from-90-to-45/)
- [RFC 9773: ACME Renewal Information (ARI)](https://www.rfc-editor.org/rfc/rfc9773)

---
Source: https://nameward.app/guides/100-day-ssl-certificates (updated 2026-10-30)