If you’ve paid for an SSL certificate in the past, you probably remember it lasting a year, or even two. Those days are over. Since 15 March 2026, newly issued public SSL/TLS certificates can last no more than 200 days, and that limit is set to fall twice more.
The new timetable
In April 2025, the CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules for website certificates, approved a ballot (SC-081) that shortens certificate lifetimes in stages:
| Certificates issued from | Maximum lifetime |
|---|---|
| Before 15 March 2026 | 398 days (about a year) |
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
Certificates already issued keep the lifetime they were issued with, so nothing stops working overnight.
Why certificates are getting shorter
A certificate is a promise that a website is who it says it is. The longer a certificate lasts, the longer a mistake or a stolen key can go on being trusted. Shorter lifetimes mean information is re-checked more often and problems age out faster. The catch is that certificates need replacing far more often: by 2029, roughly every six weeks.
What it means for you
If you renew certificates by hand, this is a real problem. Replacing a certificate eight or more times a year, without ever missing one, isn’t realistic for a small business. And when a certificate expires, browsers show visitors a full-page security warning, which most people won’t click past.
The answer is automation. Certificates that are issued and renewed automatically don’t care whether they last a year or 47 days.
Three things to check this week
- Find every certificate you rely on. Your website is the obvious one, but don’t forget subdomains, a shop on another platform, or a mail server.
- Check each one renews automatically. If any certificate was bought and installed by hand, find out who renews it and when.
- Make sure expiry warnings reach someone. Renewal reminders go to the email address on the account. If that’s an old address or someone who has left, you won’t hear about a problem until customers do.
Do I still need to pay for a certificate?
For most websites, no. A free, automatically renewed certificate gives exactly the same encryption as a paid one. Paid certificates still have a place where you want your organisation’s identity checked and recorded in the certificate, but they will need the same frequent replacement, so automation matters for them too.
Sources
Free SSL that renews itself
Every Fusionhost hosting plan includes free SSL certificates, issued and renewed automatically.
