Website certificates now expire in 200 days, and the cap drops to 47 by 2029

The padlock beside a web address tells you two things: the connection is encrypted, and the site holds a certificate from an authority your browser trusts. That certificate has an expiry date, and since March it arrives much sooner.

The new schedule

The CA/Browser Forum, where certificate authorities and browser makers set the rules, has written a staged cut into its Baseline Requirements:

• Until 14 March 2026: 398 days at most.
• From 15 March 2026: 200 days.
• From 15 March 2027: 100 days.
• From 15 March 2029: 47 days.

The window for reusing proof that you control a domain shrinks with it: 200 days now, 100 days in 2027, and just 10 days in 2029.

Why it matters this month

Certificates issued at the new limit in mid-March ran out in early October, half the interval site owners were used to. A once-a-year manual renewal is now a twice-a-year chore, and from March 2027 it comes round roughly every three months.

What to do

If you only browse, nothing. Your browser checks the certificate on every visit and shows a full-page warning when one lapses. To see a site’s expiry date yourself, click the padlock or site-settings icon next to the address and open the connection or certificate details.

If you own a site, for a shop, a restaurant or a small company, ask whoever runs your hosting one question: is renewal automatic? Most hosts renew through the ACME protocol, the mechanism behind free certificates. A site that relies on a calendar reminder will one day greet visitors with a warning page instead of its homepage.

One thing has not changed. A certificate proves the connection is encrypted and that the domain belongs to whoever requested it, not that the site is honest. Scam sites carry padlocks too.

Photo: A row of server racks in a data centre in India, not in Kuwait. By PiDatacenters, CC BY-SA 4.0 via Wikimedia Commons.

Source: CA/Browser Forum, Baseline Requirements for server certificates, section 6.3.2.