A few years ago, it was still the norm to purchase an SSL certificate once, install it, and then not have to worry about it for a year. That era is now over: since 15 March 2026, a certificate can be valid for a maximum of 200 days, and this limit will be further reduced in the coming years, falling to 47 days from 2029.

Who decides on the validity of certificates?

The rules governing certificates are set by the CA/Browser Forum. This is a joint organisation of certificate authorities (CAs) and browser manufacturers (Apple, Google, Microsoft, Mozilla). Every certificate authority must comply with the Baseline Requirements adopted by the forum; otherwise, browsers will not accept their certificates.

The maximum validity period has gradually decreased in recent years:

Period	Maximum validity
From 1 March 2018	825 days (approx. 27 months)
From 1 September 2020	398 days (approx. 13 months)
From 15 March 2026	200 days
From 15 March 2027	100 days
From 15 March 2029	47 days

The 398-day limit was originally introduced by Apple: from 1 September 2020, Safari and Apple’s systems no longer accepted certificates with longer validity periods, and other providers followed suit. The CA/Browser Forum voted on a further reduction in April 2025 (proposal SC-081). The proposal was supported by the certificate authorities without any dissenting votes, and by the four major browser manufacturers unanimously.

The validity period of the audit is also being shortened

Before issuing the certificate, the registrar checks that the applicant does indeed have control over the domain. Until now, this check (domain validation) could be reused for 398 days, meaning it did not need to be repeated for a year. This period is also being reduced: from 2026 it will be 200 days, from 2027 it will be 100 days, and from 2029 it will be just 10 days. In practice, this means that from 2029 onwards, ownership of the domain will have to be verified again whenever a certificate is issued.

The verification of organisational details (company name, address), which is required for Organisation Valid (OV) and Extended Validation (EV) certificates, will remain valid for 398 days from 2026; it is therefore sufficient to repeat this process annually.

Why is this useful?

At first glance, the shorter validity period simply means more work. However, there are serious security reasons behind this decision:

• Revocation does not work reliably. If a certificate’s private key falls into the wrong hands, the certificate can be revoked, but browsers often do not check revocation lists, or only do so with a delay. A stolen key can therefore be exploited until the certificate expires. The shorter the validity period, the shorter this window of opportunity.
• Domains change hands. If a domain expires and is transferred to someone else, the previous owner’s certificate may remain valid for several months. Due to the shorter validity period and more frequent checks, the certificate is transferred to the actual owner sooner.
• The switch can be made more quickly. If an encryption method is found to be no longer secure (or if new algorithms need to be adopted due to quantum computers), short-lived certificates are replaced within a few weeks, rather than over several years.
• It forces automation. Manually installed certificates are regularly overlooked, leading to downtime caused by expired certificates. If certificates need to be replaced frequently anyway, everyone automates the process, and errors caused by expiry are eliminated.

What about Let’s Encrypt’s 90-day certificates?

Let’s Encrypt’s free certificates have been valid for 90 days from the outset and have always been based on automatic renewal. For a long time, this was considered a ‘short-term’ certificate, and Google also recommended the 90-day maximum to the entire industry. The rule that was eventually adopted goes even further than this, and Let’s Encrypt is also shortening the validity of its certificates even further:

Date	Let’s Encrypt default validity period
currently	90 days
From 10 February 2027	64 days
From 16 February 2028	45 days

Anyone who wishes to do so can now request a 45-day or even a 6-day certificate from Let’s Encrypt.

Let’s Encrypt also requests that renewal should not take place at fixed intervals (for example, every 60 days), as this would be too late for certificates with validity periods of 64 and 45 days. Renewal should begin at roughly two-thirds of the certificate’s lifetime, or, if the renewal program supports it, based on ACME Renewal Information (ARI), when the issuer indicates that it is time to renew.

What does this mean for you?

If you are using a free certificate on aWh’s hosting

You do not need to do anything. On our web hosting plans, the system automatically requests and renews certificates for all domains pointing to our name servers (see: Enabling free Let’s Encrypt certificates on web hosting). The shorter validity period simply means that the certificates are replaced more frequently in the background.

Please note that if you manage your domain’s DNS elsewhere, or if there is a proxy (such as Cloudflare) in front of your hosting, the domain ownership verification must still be successful. If the renewal fails, this will become apparent sooner due to the more frequent renewal cycle, but the certificate will also expire sooner.

If you are using a paid certificate

You can still purchase a paid certificate for a period of one or more years, but the certificate will need to be reissued and installed several times during that period: at least twice a year from 2026, quarterly from 2027, and roughly every six weeks from 2029. These reissues are free of charge until the subscription expires; however, proof of control over the domain must be provided each time (see: Methods of domain validation).

If the domain is hosted on one of our cPanel hosting accounts, please set up the certificate in the client portal using the Autoinstall (via cPanel) option: in this case, validation, installation and reissuance are all automatic. For certificates installed on another server, you will need to carry out the reissuance yourself; we will send you a reminder by email. Both scenarios are described in the article ‘Setting up and reissuing a Paid SSL certificate’.

If you do not need an OV or EV certificate, it is worth considering a free, automatically renewing certificate; see: Let’s Encrypt or paid SSL: which should I choose?

If you run your own server

Manual certificate renewal will be practically unsustainable by 2029, so it is worth automating the process now:

• Use an ACME client (such as Certbot or acme.sh); see: Requesting a Let’s Encrypt certificate with Certbot and Wildcard Let’s Encrypt certificate with DNS validation.
• Check whether the renewal is tied to a fixed interval (for example, 60 days). If so, set it to two-thirds of the service lifetime, or use a client that supports ARI.
• Also bear in mind those devices onto which you usually upload the certificate manually: mail servers, load balancers, routers, printers and internal applications.
• Set up alerts for certificate expiry; see: How can I check when my SSL certificate is due to expire?

What will happen to certificates that have already been issued?

The changes only affect new certificates. A certificate issued previously remains valid until its expiry date, even if its validity period is longer than that specified under the new rules. However, upon the next renewal, the new, shorter validity period will apply.