In this guide · 8 sections
- 01The new SSL certificate validity schedule (2026 to 2029)
- 02What this means if you pay for a yearly SSL certificate
- 03Who renews your certificate on common setups
- 04Let's Encrypt is shortening its certificates too
- 05How to automate SSL renewal on your own server
- 06Monitor certificate expiry so it never surprises you
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Under CA/Browser Forum ballot SC-081, certificates issued from 15 March 2026 can last at most 200 days, from 15 March 2027 100 days, and from 15 March 2029 47 days. If your host renews automatically, do nothing; if someone installs them by hand, switch to automatic renewal now.
The new SSL certificate validity schedule (2026 to 2029)
In April 2025 the CA/Browser Forum, where certificate authorities and browser makers agree the rules for public certificates, passed ballot SC-081v3. It added a schedule to section 6.3.2 of the Baseline Requirements.
| Certificate issued | Maximum validity | Renewals per year (roughly) |
|---|---|---|
| Before 15 March 2026 | 398 days | 1 |
| 15 March 2026 to 14 March 2027 | 200 days | 2 |
| 15 March 2027 to 14 March 2029 | 100 days | 4 |
| From 15 March 2029 | 47 days | 8 or more |
The same ballot also shortens how long a certificate authority can reuse a domain-ownership check, down to 10 days by 2029. In practice that means renewals need a fresh automated check, not an email someone clicks once a year.
What this means if you pay for a yearly SSL certificate
If you buy an SSL certificate from your host or a certificate authority each year, the purchase still covers a year, but no single certificate can. DigiCert, for example, says on its annual plans page that it stopped issuing 397-day certificates on 24 February 2026, and that a one-year order now includes a 199-day certificate that you reissue within the plan.
So someone has to request, validate and install a new certificate partway through the year, and by 2029 every six weeks or so. If that someone is a person with a calendar reminder, it will eventually be missed. Our guide to SSL certificate cost, free vs paid explains when a paid certificate is still worth it; for most small business websites a free, automatically renewed certificate is enough.
Who renews your certificate on common setups
Most small business sites already renew automatically. The table shows where the work sits and what to check.
| Setup | Who renews | What to check |
|---|---|---|
| Hosted platform (Shopify, Wix, Squarespace) | The platform | Custom domain still points correctly; nothing to install |
| Shared hosting with cPanel or Plesk | Host's AutoSSL or Let's Encrypt tool | AutoSSL is on for every domain and subdomain; paid certificates may need manual reissue |
| Cloudflare in front of your site | Cloudflare for the edge certificate | Origin certificate on your server and DNS validation still working |
| VPS or cloud server you manage | Your ACME client (Certbot, Caddy, acme.sh) | Renewal timer runs and the web server reloads after renewal |
| Paid certificate installed by hand | A person | Move to automatic renewal or a CA that supports ACME |
Cloudflare's validity and renewal page says its Universal certificates last 90 days and renewal attempts start 30 days before expiry. The certificate between Cloudflare and your server (the origin certificate) is separate and can be long-lived, so check both.
Let's Encrypt is shortening its certificates too
Let's Encrypt, the free certificate authority most hosts use, already issues 90-day certificates. It is moving faster than the industry deadline, according to its 64-day announcement (7 October 2026) and its earlier 45-day plan.
- 13 May 2026: the opt-in tlsserver profile switched to 45-day certificates.
- 10 February 2027: the default profile issues 64-day certificates, with a 10-day authorisation reuse period.
- 16 February 2028: the default moves to 45-day certificates with a 7-hour reuse period.
Let's Encrypt says automated setups whose client supports ACME Renewal Info (ARI) should need no change. Scripts that renew a fixed number of days before expiry (it suggests searching for numbers like 83, 80 or 60 in cron jobs) should switch to renewing at about two-thirds of the certificate's lifetime.
How to automate SSL renewal on your own server
If you or your developer run a VPS, these steps make renewal automatic and visible.
List every certificate you have
Main domain, www, shop, booking, mail and any API subdomain. Check each in a browser or with an SSL checker and note the issuer and expiry date.
Use an ACME client for each one
Certbot, Caddy, Traefik or acme.sh request and renew certificates automatically from Let's Encrypt or another ACME-capable CA.
Check the renewal timer and reload
Confirm the systemd timer or cron job exists and that the web server reloads after a new certificate is written, or visitors keep seeing the old one.
Prefer DNS or HTTP validation that works unattended
Email-based validation does not suit short certificates. Make sure the validation method works without a person clicking a link.
Test a dry run
Run the client's dry-run or staging mode (for Certbot, certbot renew --dry-run) and fix errors before they matter.
Add expiry monitoring
Set an external monitor to alert you at 14 and 7 days before expiry, so a failed renewal is caught early.
Monitor certificate expiry so it never surprises you
Automation fails quietly: a DNS change breaks validation, a firewall blocks the check, or a server reload never happens. An outside monitor that alerts on upcoming expiry catches all of these. Many uptime tools include SSL expiry checks; our uptime monitoring tools guide compares them.
SSL renewal checklist
If a certificate has already expired, our expired SSL certificate fix guide walks through getting the site back in minutes.
Do it yourself or get help?
On Shopify or a host with AutoSSL, a ten-minute check of the table above is usually enough. If you run your own server, have a paid certificate installed by hand, or are not sure who renews what, get it sorted before the 100-day limit arrives in March 2027.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our Website Security Hardening (S$290) enforces HTTPS and security headers along with updates, firewall and backups. Our Monitor plan (S$29 a month) watches uptime, SSL and domain expiry and alerts you before customers notice.
Frequently asked questions
For public TLS certificates issued on or after 15 March 2026, the maximum validity is 200 days under the CA/Browser Forum Baseline Requirements. It falls to 100 days for certificates issued from 15 March 2027 and to 47 days from 15 March 2029. Certificates issued before each date keep their original expiry.
Usually not. Hosted platforms issue and renew certificates for connected custom domains themselves. The main thing to check is that your domain's DNS records still point to the platform, because renewal validation fails if they have been changed. If the platform shows a certificate warning in its domain settings, fix it promptly.
For most small business websites, no. A free certificate gives the same encryption and the same browser padlock. Paid OV or EV certificates add identity checks and warranties, but they now need reissuing at least twice a year and are harder to automate. Pay only if a customer, tender or regulator specifically asks for one.
Browsers show visitors a full-page security warning, and most people leave rather than click through. Forms, checkouts and payment pages may stop working. Search engines and email links to the site are affected too. Renewing and installing a new certificate fixes it, but the visitors lost in the meantime are gone.
Shorter certificates limit how long a stolen or wrongly issued certificate can be misused, and they force automated renewal, which makes it easier for the industry to replace weak algorithms quickly. The CA/Browser Forum adopted the schedule in ballot SC-081v3 in April 2025, with the first cut taking effect on 15 March 2026.