TLS certificates are getting shorter: 200 days now, 100 days in 2027
The 200-day maximum is already in force, Let's Encrypt moves to 64-day and then 45-day certificates, and hardcoded renewal intervals need to change now.
By the Maborak engineering team · · 3 min read
Certificate lifetime is no longer a stable 398 days. Since 15 March 2026 the CA/Browser Forum Baseline Requirements cap publicly trusted subscriber certificates at 200 days, with further reductions already scheduled. Renewal automation that assumes 90-day certificates and a 60-day renewal interval is close to the edge today and will break before 2028.
Checked 29 October 2026. The dates and limits below come from the CA/Browser Forum Baseline Requirements and Let’s Encrypt’s published schedule and profile documentation. This is a planning change, not a vulnerability report.
The schedule
| Effective | Maximum subscriber certificate validity | Domain validation reuse |
|---|---|---|
| 2026-03-15 | 200 days | 200 days |
| 2027-03-15 | 100 days | 100 days |
| 2029-03-15 | 47 days | 10 days |
The limit applies when a certificate is issued; certificates issued before a date keep their original validity until they expire. The source is the CA/Browser Forum Baseline Requirements, which lists the compliance dates against sections 6.3.2 (validity) and 4.2.1 (validation reuse).
What Let’s Encrypt has announced
- The default “classic” profile still issues 90-day certificates today.
- The opt-in
tlsserverprofile issues 45-day certificates from 13 May 2026. - The default classic profile moves to 64-day certificates on 10 February 2027.
- The default classic profile moves to 45-day certificates on 16 February 2028.
- A
shortlivedprofile issues certificates valid for about 6 days.
These are Let’s Encrypt’s own dates, published in the 45-day announcement and the certificate lifetimes page. Other publicly trusted CAs have the same 200/100/47-day ceiling but their own rollout choices.
What breaks
- A hardcoded 60-day renewal. Let’s Encrypt states explicitly that a fixed 60-day interval is no longer sufficient once certificates are valid for 45 days. Renew at roughly two thirds of the current lifetime, or let an ACME client use the ACME Renewal Information (ARI) extension to pick the time.
- Expiry-only monitoring. A certificate-expiry alert tells you the certificate is about to expire, not that renewal has been failing for two cycles. Alert on renewal errors and on a certificate that has not renewed by an expected point, not only on
notAfter. - Assuming a lifetime. A certificate that is valid but 90 days when you expect 45 usually means renewal wrote to a different path, or a proxy still serves the old file. Compare the served certificate with the one that was deployed.
- Manual issuance. More renewals multiplied by manual steps is more opportunities to miss one. Short lifetimes assume automation.
What to change now
- Prefer an ACME client that supports ARI and renews relative to the current lifetime. If the client cannot use ARI, schedule renewal at about two thirds of the lifetime and verify it against a shortened certificate.
- Monitor three things separately: days to expiry, the last successful renewal, and whether the certificate actually served on each endpoint matches the deployed one.
- Inventory every certificate, issuer, ACME account and renewal owner, including certificates on internal load balancers and mail hosts.
- Exercise the 2027 path in staging now: request a 100-day or shorter certificate, confirm your tooling renews and reloads it, and confirm the old certificate is replaced everywhere it is served.
Checking what is served
Inspect the certificate on disk and the one on the wire separately:
openssl x509 -noout -subject -issuer -dates -in /path/to/cert.pem
openssl s_client -connect host.example:443 -servername host.example </dev/null 2>/dev/null \
| openssl x509 -noout -datesCompare the validity interval between notBefore and notAfter with the profile you expect. A mismatch is a deployment problem even when the certificate is still valid.
The 200-day limit is already in force, so any process that issues or renews certificates today is subject to it. The March 2027 reduction to 100 days is the deadline that makes automation a requirement rather than a convenience.
