Every website that uses a publicly trusted TLS certificate is on a timetable it did not choose. A rule adopted by the CA/Browser Forum in April 2025 caps the lifetime of such certificates at 200 days since March 15, 2026, cuts it to 100 days on March 15, 2027, and lands at 47 days on March 15, 2029. The period for which a certificate authority may reuse a domain validation shrinks on the same dates, down to 10 days at the end.
Let's Encrypt said on October 7, 2026 that it will move ahead of that schedule. From February 10, 2027 the default lifetime of its certificates drops from 90 days to 64, with 45 day certificates to follow in 2028, and the last 90 day certificate it issues is expected to expire on May 11, 2027. For anyone still renewing certificates by hand, or with a script that assumes a renewal every two or three months, the arithmetic stops working well before the 2029 deadline.
The schedule and the reasoning behind 47
The ballot, numbered SC081 and proposed by Apple's Clint Wilson with endorsements from Sectigo, Google Chrome and Mozilla, passed on April 11, 2025 with 25 certificate authorities in favor, none against and five abstaining; Apple, Google, Microsoft and Mozilla all voted yes as browser makers. Google had earlier promoted a 90 day maximum before backing the Apple proposal. Until March 2026 the ceiling was 398 days. Validation data ages faster under the new rules too: the organization details in an OV or EV certificate may be reused for 398 days instead of 825, and domain control checks for 200 days, then 100, then 10. DigiCert explains the odd final figure as one maximal month of 31 days plus half of a 30 day month plus a day of slack, and notes that the gap between the second and third steps is two years rather than one.
Why the industry wants shorter lives
The case made in the ballot rests on a few observations. A certificate records facts that were true at the moment of issuance, and those facts drift: domains change hands, keys leak, companies restructure. The longer a certificate lives, the longer a stale or misissued one keeps working. Revocation was meant to handle that, but the ballot calls certificate status services inadequate at internet scale, citing privacy, performance and reliability problems; browsers often skip the checks, and not every certificate that should be revoked ever is.
A short lifetime, by contrast, is enforced by every client without exception. The baseline requirements have long required revocation within 24 hours in certain cases, which the ballot's authors read as an expectation that any certificate can be replaced within a day, and they note that practice never matched it. Shorter lives also make it easier to retire a weak algorithm quickly. Let's Encrypt gives two reasons of its own: less damage from key compromise and misissuance, and a push toward automation, which is why it settled on 90 days when it launched in 2015, long enough then to renew by hand, short enough to make scripting attractive.
What breaks first
The failure modes are mundane. A renewal cron job hardcoded to run 60 days after issuance will miss a 45 day certificate entirely, which is why Let's Encrypt suggests searching scripts and runbooks for numbers such as 83, 80 and 60 and renewing at roughly two thirds of whatever the lifetime is. Appliances, load balancers and embedded devices that accept a certificate only through a management console cannot keep pace with renewals every few weeks. Applications that pin a specific leaf certificate will break at each rotation. Validation reuse goes the same way: Let's Encrypt is cutting its authorization reuse window from 30 days to 10 days in February 2027 and to seven hours in 2028, so any client designed to lean on a cached validation will have to prove domain control almost every time.
What to automate before the first deadline
- Put every public certificate under an ACME client and switch on ACME Renewal Information, which lets the authority tell the client when to renew; where that is not supported, renew at two thirds of the lifetime rather than at a fixed number of days.
- Build an inventory of every certificate in use, including those on appliances, in cloud load balancers and inside containers, and add monitoring that alerts on a failed renewal rather than on an expiry a few days out.
- Test the whole chain in a staging environment first; Let's Encrypt scheduled its staging service to move to 64 day certificates on October 14, 2026 for exactly that purpose.
The 2029 deadline sounds distant, but the step most likely to catch organizations out is the one in March 2027, when 100 days becomes the ceiling and a six month renewal routine no longer fits inside the rules for any public certificate. DigiCert has told its customers that manual revalidation will remain technically possible under the 2029 rules but amounts to a recipe for outages. Its advice and Let's Encrypt's converge on the same point: a certificate that renews itself every few weeks is boring, and boring is the goal.
