Key Takeaways
Did you know your SSL/TLS certificate renewal window shrank in half last week? A new industrywide rule dropped the maximum lifespan from 398 days to 200.
It was approved by the CA/Browser Forum last year when members voted unanimously to reduce the SSL/TLS renewal timeframes after Apple pitched the motion just a few months before, arguing:
Shorter lifetimes limit the impact of misissuance and key compromise . . . The industry is moving toward more frequent validation to ensure that certificate data remains accurate and trustworthy over time.
By March 2027, it will go down to 100 days; by March 2029, every 47 days. That last phase in 2029 will also introduce a new limit on domain control validation (DCV) windows, down to only 10 days.
Here’s the SSL/TLS Lifespan Timeline
| Phase | Effective Date | Certificate Lifespan | Domain Validation (DCV) Reuse Window |
| Previously | Before 2026 update | 398 days | ~30 days |
| Phase 1 | 2026 (now in effect) | 200 days | ~30 days |
| Phase 2 | March 2027 | 100 days | ~30 days |
| Phase 3 | March 2028 | 47 days | ~30 days |
| Final Phase | March 2029 | 47 days | 10 days |
Notice that 2028 is missing. That’s probably on purpose, Tim Callan, the CCO at Sectigo, suggests.
“This approach gives subscribers the opportunity to prioritize deployment of automation solutions without immediately facing a crisis if all certificates are not automated,” Callan told HostingAdvice.
As for why the steep drops, it all comes down to the state of internet security. It’s hard to argue with the logic: Shorter lifespans would mean less damage if a certificate is stolen, issued incorrectly, or compromised.
About 10-15 years ago, TLS certificates could be valid for up to five years. Apple was the first to really push back on this by having its browser, Safari, reject certificates that were older than two years old. Since nobody wanted to be blacklisted, everyone else had to follow suit.
What Shorter SSL Lifespans Mean for Hosts
If an SSL certificate is issued to the wrong party and remains valid for a year, that’s a long window. It happened in 2011 when Dutch certificate authority company DigiNotar was hacked and issued hundreds of fraudulent certificates. Domains, of course, aren’t immune either. They, too, get passed around like a hot potato.
Customers — site owners, SMBs, devs, agencies — will begin asking: Does my hosting provider handle renewals for me, or do I have to do that myself?
Providers like Cloudflare, SiteGround, and Kinsta automatically issue and renew certificates using ACME-based systems like Let’s Encrypt. Control panels like cPanel and Plesk have also been doing this for years. Providers can make sure they’re doing their part by offering:
- Fully automated issuance and renewal (ACME, for example)
- No customer involvement in renewals at all
- Clear SSL status in the dashboard (if certificates are expiring every few weeks, it’s not a bad idea to show customers that it’s being handled)
It’s funny to think about — this regulation isn’t really about SSL certificates on their own. It’s more so about how the web’s evolved and what people expect now: more proof that automation is the new standard, and anything that still relies on manual upkeep is light-years behind.
Luckily, that’s where the good hosts will have the opportunity to shine the most.
