Under CA/Browser Forum ballot SC-081, no publicly trusted SSL/TLS certificate can now be valid for more than 200 days, and the limit falls to 100 days on 15 Mar 2027. Here's what's changing, why, and how your plan still covers the full period you paid for.
The certificate lifetime schedule
The CA/Browser Forum is the industry body whose rules every publicly trusted certificate authority, including Sectigo and DigiCert, must follow. Ballot SC-081 set this schedule for the maximum validity of a single certificate and for how long a domain check can be reused:
| Certificates issued | Maximum validity | Domain check reusable for |
|---|---|---|
| Before 15 Mar 2026 | 398 days | – |
| Since 15 Mar 2026 (now) | 200 days | 200 days |
| From 15 Mar 2027 | 100 days | 100 days |
| From 15 Mar 2029 | 47 days | 10 days |
These limits apply to the certificate itself, not to the term you buy, and they apply to every CA and every seller. No one can issue a longer publicly trusted certificate.
Why are lifetimes shrinking?
Shorter-lived certificates are better for security:
- Less exposure if something goes wrong. If a private key is compromised or a certificate is mis-issued, a shorter lifetime limits how long it can be abused.
- Fresher validation. Domain checks can be reused only for a limited time (200 days today), so control of a domain is re-proved more often.
- A push toward automation. Shorter cycles encourage automated issuance and renewal, which is more reliable than manual work.
"So why does my certificate expire before my term ends?"
This is the part that surprises people. If you buy a 1-year (or longer) plan today, the CA still can't issue a single certificate that lasts a year: the maximum is 200 days. So your purchase isn't one long certificate; it's a plan. You get a certificate now, and before it expires you reactivate it free to get the next one, until the full term you paid for is used up.
How we manage this for you
- One dashboard tracks every certificate, its status and its next reactivation date.
- Reminders reach you 30, 14 and 3 days before each expiry.
- Guided reactivation. When it's time, we walk you through a quick CSR and domain validation, and the next certificate issues against your plan. See how plan reactivation works.
What you should do
- Choose a plan, not a certificate. Buy the term you need; each new certificate within it is free.
- Watch for our reminders and the dates in your dashboard, or set up free expiry alerts for every site you run.
- Keep DNS validation in place so each re-check is automatic.
Common questions
How many certificates will my plan include?
At least two in a 1-year plan today, and more for certificates issued from 15 Mar 2027. Your dashboard shows when each reactivation is due.
Do these limits apply to private or internal CAs?
No. They apply to publicly trusted TLS certificates, the kind browsers trust by default.
Is a longer plan still worth it?
It fixes your price and paperwork for the whole term, with one invoice, and every certificate within it is free.