Next step on 15 March 2027: 100-day certificates and 100-day domain checks

Since 15 March 2026 public TLS certificates have been limited to 200 days. The next step of CA/Browser Forum Ballot SC-081 takes effect on 15 March 2027:

• maximum certificate lifetime: 100 days;
• a completed domain validation can be reused for 100 days (down from 200);
• from 15 March 2029 certificates last at most 47 days and a domain check can be reused for only 10 days.

How to be ready

• Use DNS validation and leave the record in place, so repeat checks complete without anyone doing anything.
• Check your CAA records still name your CA - our DNS checker shows the exact record to add.
• Buy a plan, not a single certificate: a plan is paid once and covers every reactivation until its end date, so shorter lifetimes don't mean more purchases.
• Watch expiry dates: the free expiry monitor emails you 30, 14 and 3 days before a certificate expires.