Public TLS certificates now last at most 200 days, and 100 days from March 15, 2027: find every manual install

The CA/Browser Forum Baseline Requirements cut publicly trusted TLS certificate validity to 200 days for certificates issued from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Manually installed certificates will need replacing far more often.

Source facts

Section 6.3.2 of the Baseline Requirements limits subscriber certificates issued on or after March 15, 2026 to a maximum validity of 200 days, those issued on or after March 15, 2027 to 100 days, and those issued on or after March 15, 2029 to 47 days. Certificates issued before March 15, 2026 kept the earlier 398-day maximum. Section 4.2.1 shortens reuse of domain-validation data on the same dates, from 398 days to 200, then 100, then 10 days.

The schedule was adopted through Ballot SC081v3, which all four certificate-consumer voters, Apple, Google, Microsoft and Mozilla, supported.

Let’s Encrypt says its default classic ACME profile will issue 64-day certificates with a 10-day authorization reuse period from February 10, 2027, and 45-day certificates from February 16, 2028. It warns that renewing at a hardcoded 60-day interval will no longer be sufficient and recommends ACME Renewal Information and monitoring for missed renewals.

Applicability

The validity limits apply to publicly trusted TLS server certificates. Certificates from a private, internal certificate authority are governed by that organization’s own policy, so classify each certificate by issuer before planning.

DSE recommendation

DSE recommends identifying every publicly trusted certificate that is renewed or installed manually and moving it to automated issuance before the 100-day limit begins on March 15, 2027. For devices that cannot run an ACME client, decide whether to front them with a proxy, switch them to an internal certificate authority with distributed trust, or record a manual replacement schedule with an owner. Configure ACME clients to use renewal information or to renew about two-thirds of the way through each certificate’s life.

Verification

Export the certificate inventory and flag any certificate whose issuance date and validity exceed the limit for its issue date, any renewal job with a fixed 60-day or longer interval, and any public certificate without an automated renewal owner. Confirm expiry alerts fire by testing them against a short-lived test certificate.

Official references

CA/Browser Forum — Baseline Requirements for Publicly-Trusted TLS Server Certificates (Sections 4.2.1 and 6.3.2). CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. Let’s Encrypt — Decreasing Certificate Lifetimes to 45 Days. Reviewed October 18, 2026.