Upcoming Changes to SSL/TLS Certificate Lifetimes

The SSL/TLS industry is continuing its move toward shorter certificate lifetimes. Following CA/Browser Forum requirements, these changes will affect all publicly trusted Certificate Authorities (CAs) and will apply to newly issued SSL/TLS certificates across the market.

As the new rules take effect,the maximum validity of a newly issued public SSL/TLS certificate will be reduced to approximately 6 months (199 days). Certificates issued before the enforcement dates will remain valid until their normal expiration date (unless revoked).

DCV checks

In addition, the ability to reuse Domain Control Validation (DCV) in certain reissue/replacement scenarios will also shorten to roughly six months, meaning customers will encounter DCV checks more frequently than before.

For example, Sectigo has announced it will begin enforcing the new issuance rules on March 12, 2026, ahead of the CA/Browser Forum requirement starting March 15, 2026. Other publicly trusted CAs will follow the same direction as the industry timelines are adopted.

Subscriptions

These changes do not remove multi-year purchasing options: you can still buy 1-5 year TLS subscriptions, but each issued certificate will be valid for up to ~6 months. As a result, even 1-year subscriptions will require reissuance during the term, and certificates issued near the end of a term may be valid only for the remaining time (e.g., 30 days remaining results in a 30-day certificate).

With more frequent reissuance, manual workflows may lead to more support requests and a higher risk of outages if renewals are delayed. We strongly recommend reviewing renewal processes and prioritizing automation to reduce operational overhead and ensure continuous coverage.