How Long Do SSL Certificates Last? 200, 100 and 47-Day Lifetimes

How long are SSL certificates valid?

How long are SSL certificates valid? As of October 2026, a publicly trusted SSL/TLS certificate issued on or after 15 March 2026 is valid for at most 200 days. Under CA/Browser Forum ballot SC-081, the maximum drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029. Certificates issued before 15 March 2026 could still run up to 398 days.

The CA/Browser Forum is the group of certificate authorities and browser makers that sets the Baseline Requirements every public certificate must follow. Its limit applies to every brand and validation level – DV, OV and EV alike.

Key fact	As of October 2026
Maximum lifetime today	200 days (issued from 15 Mar 2026)
Next step	100 days from 15 Mar 2027
Final step	47 days from 15 Mar 2029
Rule source	CA/Browser Forum ballot SC-081
Applies to	All publicly trusted TLS certificates, any CA, any validation level
Plan term at BUY-SSL.com	1, 2 or 3 years – separate from certificate lifetime

What are 47-day SSL certificates and when does the change happen?

A 47-day SSL certificate is a certificate issued under the final step of ballot SC-081: from 15 March 2029, no public TLS certificate may be valid for more than 47 days. The change happens in three steps, and the period for which a CA may reuse an earlier domain check shrinks alongside it.

Issued on or after	Max. certificate lifetime	Max. domain validation reuse	Certificates needed per year (minimum)
Before 15 Mar 2026	398 days	398 days	1
15 Mar 2026	200 days	200 days	2
15 Mar 2027	100 days	100 days	4
15 Mar 2029	47 days	10 days	8

Why domain validation reuse matters

Domain control validation (DCV) is the check that proves you control a domain – by email, DNS record or HTTP file. Today a CA can reuse a recent check when you reissue. From 2029, reuse falls to 10 days, so nearly every new certificate will need a fresh check. Manual email approvals will not keep up; DNS-based or automated validation will.

Organization details checked for OV and EV certificates can also be reused for a limited time only. How each check works is covered in how SSL validation works.

Are SSL certificates changing to 90 days?

Not as an industry rule. In 2023 Google said in its Chrome root program roadmap that it planned to propose a 90-day maximum, which drew wide attention. That proposal was never adopted as a rule. Instead, CA/Browser Forum members approved ballot SC-081 in 2025, with the 200 → 100 → 47-day schedule above. A 90-day SSL certificate today is simply a certificate some issuers, such as Let’s Encrypt, choose to issue with a shorter life.

Why do SSL certificates expire at all?

SSL certificates expire so that a certificate’s claims – this key belongs to this domain – are re-checked regularly and any mistake or compromise dies out on its own. Expiry is the one safety mechanism that works even when revocation checks fail.

Every certificate carries a fixed start and end date set by the CA at issuance. You cannot extend a certificate; you replace it with a new one.

Why are SSL certificates only 1 year? A short history

Lifetimes have shrunk in steps for more than a decade. The one-year norm many people still remember was the 398-day limit that applied from September 2020 until March 2026.

1. Before 2015: certificates of up to five years were common.
2. April 2015: the Baseline Requirements capped lifetimes at 39 months.
3. March 2018: the cap fell to 825 days (about 27 months).
4. 1 September 2020: browsers, led by Apple, stopped trusting new certificates valid for more than 398 days.
5. 15 March 2026: 200 days under SC-081.
6. 15 March 2027: 100 days.
7. 15 March 2029: 47 days.

That is why a “5 year SSL certificate” no longer exists as a single certificate. A multi-year offer today is a plan that covers several certificates in a row.

Do SSL certificates expire at midnight?

No – not necessarily. A certificate expires at the exact second written in its “Not After” field, which is stored in UTC (Coordinated Universal Time). Depending on your time zone, that can be mid-afternoon or early morning locally. You can read the exact timestamp with our guide on how to check if an SSL certificate is valid.

Why pay for a 1-, 2- or 3-year SSL plan if certificates only last 200 days?

Because the plan and the certificate are two different things. At BUY-SSL.com, a 1-, 2- or 3-year option is a subscription term, and during that term you can reissue certificates; each issued certificate still follows the maximum lifetime in force when it is issued. The exact reissue terms can differ by product, so check the product page before you order.

Term	What it means	Example (as of Oct 2026)
Plan term	How long you are covered and can request certificates	1, 2 or 3 years
Certificate lifetime	How long one issued certificate is valid	Up to 200 days
Reissue	A new certificate within the same plan, often with a new CSR	Before each certificate ends
Validation reuse	How long the CA may rely on an earlier check	Up to 200 days for domain checks

Should I buy a 1-year or multi-year SSL plan?

Buy a multi-year plan when the site is long-lived and the hostnames will stay the same; it locks in the plan and cuts the number of purchases. Buy a 1-year plan when you expect to change domains, hosts or certificate type soon. Either way, you will replace the certificate itself several times as lifetimes shrink.

Good fit for a multi-year plan	Pick a 1-year plan if
Stable domain and hostnames	You may rename, merge or drop the domain
You want fewer orders and invoices	You are testing a new project
You have a reissue routine or automation	You plan to move to a different certificate type
Budget is approved for several years	Your budget is set yearly

For most sites, a domain validated (DV) SSL plan is the easiest to keep current, because each reissue needs only a domain check.

How often do SSL certificates need to be renewed?

At least twice a year as of October 2026, four times a year from March 2027, and eight times a year from March 2029. In practice you replace each certificate a few days to weeks before it ends, so the real cadence is a little higher.

“Renewal” now usually means getting and installing a new certificate within your plan, and renewing the plan itself when the term ends. The exact steps – and what to do if a certificate already expired – are in our guide on how to renew an SSL certificate.

Tip: At eight or more replacements a year, a calendar reminder is not enough. Tie every certificate to an owner, an alert and, where possible, an automated renewal job.

Tracking expiry dates, alerts and automated replacement across many servers is the job of SSL certificate management. Set it up before the 100-day limit arrives in March 2027.