New industry requirements from CA/Browser Forum

Shorter SSL Lifetime: 199, 99 and 46 Days

Since 15 March 2026 an SSL certificate can be valid for at most 199 days, and by 15 March 2027 the limit becomes 99 days, for DigiCert certificates from 24 February 2027. This means more frequent issuances, but your procurement process stays the same.

Important: You can still purchase SSL for 1 year at a time. Your order covers all technical reissuances required during the period.

1. Industry Reduction Timeline

The CA/Browser Forum has adopted a phased reduction of the maximum lifetime for SSL/TLS certificates (ballot SC-081).

Date	Max Lifetime	DCV Validity	Renewals per Year
Sep 2020 to March 2026	398 days	398 days	~1x
March 15, 2026 (current)	199 days	200 days	~2x
March 15, 2027	99 days	100 days	~4x
March 15, 2029	46 days	10 days	~8x

DCV = Domain Control Validation. With a 46-day lifetime, domain ownership must be revalidated more frequently to maintain security.

15 March 2026 · Now

199 days

15 March 2027

99 days

15 March 2029

46 days

How to Work with Certificates Going Forward

The order period and price remain the same. What changes is that each individual certificate is issued with a shorter lifetime, so you will need to install new certificates more often. The process depends on which CA you use.

DigiCert

Thawte · GeoTrust · RapidSSL

Reissue

You purchase one order period and can reissue certificates an unlimited number of times within it. All reissues are free.

1 Purchase the order period (e.g. 1 year)
2 Issue and install the first certificate
3 When the certificate approaches expiry: reissue it
4 Install the new certificate on the server
5 Repeat steps 3 and 4 until the order period expires

System action

Our system automatically shows a highlighted "Reissue" icon when it is time to act.

Sectigo

PositiveSSL

Reissue

You purchase one order period and can reissue certificates an unlimited number of times within it. All reissues are free.

1 Purchase the order period (e.g. 1 year)
2 Issue and install the first certificate
3 When the certificate approaches expiry: reissue it
4 Install the new certificate on the server
5 Repeat steps 3 and 4 until the order period expires

System action

Our system automatically shows a highlighted "Reissue" icon when it is time to act.

GlobalSign

AlphaSSL

Renewal (renew)

GlobalSign uses a renewal model rather than reissue. Renewals within the paid order period are free.

1 Purchase the order period (e.g. 1 year)
2 Issue and install the first certificate
3 The system shows a "Renew" icon when fewer than 32 days remain on the certificate
4 Click renew and install the new certificate
5 Repeat steps 3 and 4 until the order period expires

System action

Our system automatically shows a highlighted "Renew" icon when fewer than 32 days remain on the certificate.

What Does This Mean for You?

Existing Certificates: Certificates issued before the new limits retain their full validity. If you have a 1-year certificate from January 2026, it remains valid until January 2027. The new rules only apply to new issuances after the effective dates.
More Frequent Updates: Since certificates expire faster, they must be installed more often on the server. Your 1-year order covers all these issuances at no extra cost, but the technical handling must occur more frequently.

Order Period vs. Technical Issuances

Even though each certificate is only valid for e.g. 199 or 99 days, you can still purchase certificates with a 1-year order period. You simply reissue new certificates on an ongoing basis within your existing order.

Left side

1-year order period (Financial)

Right side

Technical issuances

Year 1 - 2026 (199 d.)

1-year order paid

Certificates issued with up to 199-day lifetime.

Issuance 1

Certificate (199 d.)

Issuance 2

Certificate (199 d.)

Year 2 - 2027 (99 d.)

1-year order paid

New rules: 99-day lifetime from 24 February 2027.

Iss. 3

99 d. cert.

Iss. 4

99 d. cert.

Iss. 5

99 d. cert.

Iss. 6

99 d. cert.

Year 3 - 2028 (99 d.)

1-year order paid

Still a 99-day lifetime.

Iss. 7

99 d. cert.

Iss. 8

99 d. cert.

Iss. 9

99 d. cert.

Iss. 10

99 d. cert.

Year 4 - 2029 (46 d.)

1-year order paid

New rules: 46-day lifetime.

Iss. 11

46 days

Iss. 12

46 days

Iss. 13

46 days

Iss. 14

46 days

Iss. 15

46 days

Iss. 16

46 days

Iss. 17

46 days

Iss. 18

46 days

Iss. 19

46 days

Iss. 20

46 days

Iss. 21

46 days

Iss. 22

46 days

By reissuing 15-30 days before expiry, you ensure your servers always have a valid certificate without losing paid time from your order period.

Examples: order period vs. certificate lifecycle

See how your order period covers the technical certificate issuances over time. Each coloured bar is one certificate. Hover over the bars for details.

Order: 2 years

↓ 99-day cap

199d

99d

37d

€

Oct 2026

Issue and install

€

Oct 2028

Renew order

+ issue new cert.

Reissue and install ×6

Expires every 199/99 days

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

Shorter lifetimes: timeline and automation with sslbrain

Frequently Asked Questions About the New Lifetimes

Find answers to the most common questions about SSL certificates and FairSSL.

Do my current certificates still work?

Yes. A certificate keeps the validity it was issued with. A certificate issued with 398 days of validity in February 2026 stays valid until it expires in March 2027. The new limits only apply to certificates issued after the effective date.

Why is certificate lifetime being reduced?

The CA/Browser Forum passed this by vote (ballot SC-081) to improve security. Shorter lifetimes mean more frequent validation of domain ownership, faster phasing out of compromised keys, and better alignment with cryptographic best practices.

Do I have to renew more often now?

Yes. Since 15 March 2026 at most every 199 days, from 15 March 2027 at the latest every 99 days, and from 15 March 2029 at the latest every 46 days. At DigiCert the steps come on 24 February 2027 and 24 February 2029. We recommend automating renewal so you don't have to do it manually.

Does SSL cost more as certificate lifetimes get shorter?

No. You pay for an order period, typically one year, and the price stays the same no matter how many times the certificate is reissued within that period. Since 15 March 2026 certificates must be replaced more often, and from 24 February 2027 more often still, but every reissue is included in the price. With SSL Automation from FairSSL, renewal happens automatically.

What is the difference between order period and certificate lifetime?

The order period is the time you pay for (e.g. 1 year). The certificate lifetime is how long a single certificate is valid (e.g. 199 days). You can buy a 1-year order and issue multiple certificates within that period, each with the maximum lifetime that applies at the time of issuance.

How do different CAs handle order periods?

DigiCert and Sectigo: You purchase an order period (e.g., 1 year) and can reissue certificates within the period. GlobalSign: You purchase an order and renew afterwards. A reissue gives the same end date as the original certificate.

Need Advice?

We help you navigate the new industry requirements and secure your infrastructure.

Create free account Compare certificates