SSL/TLS certificate lifespans are shrinking—dropping to 200 days in March 2026, 100 days in March 2027, and 47 days by March 2029—because 365 or 398 days leave a dangerous "exposure window" if a private key is stolen or a domain changes hands (stale certificates).
Why Shorter Lifespans Are Required
- Fixing Broken Revocation: Web browsers cannot reliably check real-time revocation lists (like CRLs or OCSP) when a certificate is compromised. Forcing a fast expiration date is the only mechanism that truly removes bad or stolen certificates from trust.
- Minimizing Stale Certificates: Old certificates often remain active long after a company changes vendors or a domain expires/changes hands. Shorter lifespans drastically shrink this attack surface.
- Enforcing Crypto Agility: Rapidly changing tech—such as the upcoming shift to post-quantum cryptography and the deprecation of older algorithms—requires frequent key rotations and updates.
- Forcing Automation: Manual renewals lead to human error and sudden website outages. Shortening validity forces organizations to adopt automated certificate lifecycle management (CLM) or ACME protocols
The Shifting Timeline
| Milestone Date | Maximum Certificate Validity |
|---|---|
| Before March 2026 | ~398 days |
| March 15, 2026 | 200 days |
| March 2027 | 100 days |
| March 2029 | 47 days |
