The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Manually installed certificates will need replacing far more often.
\nSection 6.3.2 of the Baseline Requirements limits subscriber certificates issued on or after March 15, 2026 to a maximum validity of 200 days, those issued on or after March 15, 2027 to 100 days, and those issued on or after March 15, 2029 to 47 days. Certificates issued before March 15, 2026 kept the earlier 398-day maximum. Section 4.2.1 shortens reuse of domain-validation data on the same dates, from 398 days to 200, then 100, then 10 days.
\nThe schedule was adopted through Ballot SC081v3, which all four certificate-consumer voters, Apple, Google, Microsoft and Mozilla, supported.
\nLet’s Encrypt says its default classic ACME profile will issue 64-day certificates with a 10-day authorization reuse period from February 10, 2027, and 45-day certificates from February 16, 2028. It warns that renewing at a hardcoded 60-day interval will no longer be sufficient and recommends ACME Renewal Information and monitoring for missed renewals.
\nThe validity limits apply to publicly trusted TLS server certificates. Certificates from a private, internal certificate authority are governed by that organization’s own policy, so classify each certificate by issuer before planning.
\nDSE recommends identifying every publicly trusted certificate that is renewed or installed manually and moving it to automated issuance before the 100-day limit begins on March 15, 2027. For devices that cannot run an ACME client, decide whether to front them with a proxy, switch them to an internal certificate authority with distributed trust, or record a manual replacement schedule with an owner. Configure ACME clients to use renewal information or to renew about two-thirds of the way through each certificate’s life.
\nExport the certificate inventory and flag any certificate whose issuance date and validity exceed the limit for its issue date, any renewal job with a fixed 60-day or longer interval, and any public certificate without an automated renewal owner. Confirm expiry alerts fire by testing them against a short-lived test certificate.
\nCA/Browser Forum — Baseline Requirements for Publicly-Trusted TLS Server Certificates (Sections 4.2.1 and 6.3.2). CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. Let’s Encrypt — Decreasing Certificate Lifetimes to 45 Days. Reviewed October 18, 2026.
", "content_text": "The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Manually installed certificates will need replacing far more often.\nSource facts\nSection 6.3.2 of the Baseline Requirements limits subscriber certificates issued on or after March 15, 2026 to a maximum validity of 200 days, those issued on or after March 15, 2027 to 100 days, and those issued on or after March 15, 2029 to 47 days. Certificates issued before March 15, 2026 kept the earlier 398-day maximum. Section 4.2.1 shortens reuse of domain-validation data on the same dates, from 398 days to 200, then 100, then 10 days.\nThe schedule was adopted through Ballot SC081v3, which all four certificate-consumer voters, Apple, Google, Microsoft and Mozilla, supported.\nLet’s Encrypt says its default classic ACME profile will issue 64-day certificates with a 10-day authorization reuse period from February 10, 2027, and 45-day certificates from February 16, 2028. It warns that renewing at a hardcoded 60-day interval will no longer be sufficient and recommends ACME Renewal Information and monitoring for missed renewals.\nApplicability\nThe validity limits apply to publicly trusted TLS server certificates. Certificates from a private, internal certificate authority are governed by that organization’s own policy, so classify each certificate by issuer before planning.\nDSE recommendation\nDSE recommends identifying every publicly trusted certificate that is renewed or installed manually and moving it to automated issuance before the 100-day limit begins on March 15, 2027. For devices that cannot run an ACME client, decide whether to front them with a proxy, switch them to an internal certificate authority with distributed trust, or record a manual replacement schedule with an owner. Configure ACME clients to use renewal information or to renew about two-thirds of the way through each certificate’s life.\nVerification\nExport the certificate inventory and flag any certificate whose issuance date and validity exceed the limit for its issue date, any renewal job with a fixed 60-day or longer interval, and any public certificate without an automated renewal owner. Confirm expiry alerts fire by testing them against a short-lived test certificate.\nOfficial references\nCA/Browser Forum — Baseline Requirements for Publicly-Trusted TLS Server Certificates (Sections 4.2.1 and 6.3.2). CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. Let’s Encrypt — Decreasing Certificate Lifetimes to 45 Days. Reviewed October 18, 2026.", "content_markdown": "The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Manually installed certificates will need replacing far more often.\n\n## Source facts\n\nSection 6.3.2 of the [Baseline Requirements](https://raw.githubusercontent.com/cabforum/servercert/main/docs/BR.md) limits subscriber certificates issued on or after March 15, 2026 to a maximum validity of 200 days, those issued on or after March 15, 2027 to 100 days, and those issued on or after March 15, 2029 to 47 days. Certificates issued before March 15, 2026 kept the earlier 398-day maximum. Section 4.2.1 shortens reuse of domain-validation data on the same dates, from 398 days to 200, then 100, then 10 days.\n\nThe schedule was adopted through [Ballot SC081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/), which all four certificate-consumer voters, Apple, Google, Microsoft and Mozilla, supported.\n\n[Let’s Encrypt](https://letsencrypt.org/2025/12/02/from-90-to-45) says its default classic ACME profile will issue 64-day certificates with a 10-day authorization reuse period from February 10, 2027, and 45-day certificates from February 16, 2028. It warns that renewing at a hardcoded 60-day interval will no longer be sufficient and recommends ACME Renewal Information and monitoring for missed renewals.\n\n## Applicability\n\nThe validity limits apply to publicly trusted TLS server certificates. Certificates from a private, internal certificate authority are governed by that organization’s own policy, so classify each certificate by issuer before planning.\n\n## DSE recommendation\n\nDSE recommends identifying every publicly trusted certificate that is renewed or installed manually and moving it to automated issuance before the 100-day limit begins on March 15, 2027. For devices that cannot run an ACME client, decide whether to front them with a proxy, switch them to an internal certificate authority with distributed trust, or record a manual replacement schedule with an owner. Configure ACME clients to use renewal information or to renew about two-thirds of the way through each certificate’s life.\n\n## Verification\n\nExport the certificate inventory and flag any certificate whose issuance date and validity exceed the limit for its issue date, any renewal job with a fixed 60-day or longer interval, and any public certificate without an automated renewal owner. Confirm expiry alerts fire by testing them against a short-lived test certificate.\n\n## Official references\n\n[CA/Browser Forum — Baseline Requirements for Publicly-Trusted TLS Server Certificates (Sections 4.2.1 and 6.3.2)](https://raw.githubusercontent.com/cabforum/servercert/main/docs/BR.md). [CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/). [Let’s Encrypt — Decreasing Certificate Lifetimes to 45 Days](https://letsencrypt.org/2025/12/02/from-90-to-45). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/", "url": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Public TLS certificates now last at most 200 days, and 100 days from March 15, 2027: find every manual install", "item": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/#article", "identifier": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/", "url": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/", "headline": "Public TLS certificates now last at most 200 days, and 100 days from March 15, 2027: find every manual install", "description": "The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100…", "abstract": "The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Manually installed certificates will need replacing far more often.", "articleBody": "The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Manually installed certificates will need replacing far more often.\nSource facts\nSection 6.3.2 of the Baseline Requirements limits subscriber certificates issued on or after March 15, 2026 to a maximum validity of 200 days, those issued on or after March 15, 2027 to 100 days, and those issued on or after March 15, 2029 to 47 days. Certificates issued before March 15, 2026 kept the earlier 398-day maximum. Section 4.2.1 shortens reuse of domain-validation data on the same dates, from 398 days to 200, then 100, then 10 days.\nThe schedule was adopted through Ballot SC081v3, which all four certificate-consumer voters, Apple, Google, Microsoft and Mozilla, supported.\nLet’s Encrypt says its default classic ACME profile will issue 64-day certificates with a 10-day authorization reuse period from February 10, 2027, and 45-day certificates from February 16, 2028. It warns that renewing at a hardcoded 60-day interval will no longer be sufficient and recommends ACME Renewal Information and monitoring for missed renewals.\nApplicability\nThe validity limits apply to publicly trusted TLS server certificates. Certificates from a private, internal certificate authority are governed by that organization’s own policy, so classify each certificate by issuer before planning.\nDSE recommendation\nDSE recommends identifying every publicly trusted certificate that is renewed or installed manually and moving it to automated issuance before the 100-day limit begins on March 15, 2027. For devices that cannot run an ACME client, decide whether to front them with a proxy, switch them to an internal certificate authority with distributed trust, or record a manual replacement schedule with an owner. Configure ACME clients to use renewal information or to renew about two-thirds of the way through each certificate’s life.\nVerification\nExport the certificate inventory and flag any certificate whose issuance date and validity exceed the limit for its issue date, any renewal job with a fixed 60-day or longer interval, and any public certificate without an automated renewal owner. Confirm expiry alerts fire by testing them against a short-lived test certificate.\nOfficial references\nCA/Browser Forum — Baseline Requirements for Publicly-Trusted TLS Server Certificates (Sections 4.2.1 and 6.3.2). CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. Let’s Encrypt — Decreasing Certificate Lifetimes to 45 Days. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:11+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/public-tls-certificate-maximum-validity-200-100-47-days/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Public TLS certificates now last at most 200 days, and 100 days from March 15, 2027: find every manual install" }, "articleSection": [ "Cybersecurity", "IT", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "IT", "Networks & Infrastructure", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 375, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CA/Browser Forum — Baseline Requirements for Publicly-Trusted TLS Server Certificates (Sections 4.2.1 and 6.3.2)", "url": "https://raw.githubusercontent.com/cabforum/servercert/main/docs/BR.md" } } ] } }