Certificate lifetimes: the schedule through 2029
Public TLS certificates are getting shorter-lived on a fixed schedule. Every date below comes from the sources listed at the end.
CA/Browser Forum maximum validity
Ballot SC-081v3 was approved on April 11, 2025. It lowers the maximum validity of publicly trusted certificates in steps.
| From | Maximum validity |
|---|---|
| 2026-03-15 | 200 days |
| 2027-03-15 | 100 days |
| 2029-03-15 | 47 days |
These are ceilings. Certificate authorities usually issue somewhat below each cap.
Let's Encrypt defaults
| From | Default profile lifetime |
|---|---|
| Now | 90 days |
| 2027-02-10 | 64 days |
| 2028-02-16 | 45 days |
Let's Encrypt says these are the dates the change takes effect for new certificates, so a site sees the shorter lifetime at its next renewal after each date. An opt-in profile already issues 45-day certificates (since 2026-05-13).
What it means for a client portfolio
A 90-day certificate renewed on a schedule gives a failed job about 30 days of margin. A 45-day certificate renewed at a third of its lifetime leaves about 15 days. Renewal failures turn into outages faster, so a check that measures how much of the lifetime is used matters more each year.
Sources: Let's Encrypt, From 90 to 45; Encryption Consulting, 47-day TLS certificate era (summary of SC-081v3). Checked 2026-11-14. Confirm against the CA/Browser Forum ballot text before relying on a date.