Certificates
Public TLS certificates cap at 100 days
March 15, 2027 · In 150 days
CA/Browser Forum · high confidence · Last verified October 15, 2026
What breaks
Publicly trusted TLS subscriber certificates issued on or after March 15, 2027 cannot be valid longer than 100 days. Domain and IP address validation reuse is also capped at 100 days. Certificates already issued keep the lifetime they were given.
Who is affected
- Teams that buy or issue publicly trusted TLS certificates for websites, load balancers, or devices
- Anyone still renewing by hand on a yearly calendar
- Processes that reuse domain validation for longer than 100 days
Source notes
BR 2.2.7 lists, effective 2027-03-15, section 6.3.2: the maximum validity period of subscriber certificates is 100 days. The same date sets the domain name and IP address validation reuse maximum to 100 days.
The previous step on that schedule was 200 days, effective 2026-03-15. This card is the next cap, not a Let’s Encrypt-only change. Let’s Encrypt’s own 64-day default lands earlier and is tracked separately.
Ballot SC-081v3 is the ballot that introduced the reduction schedule. The operative dates used here are the ones printed in the Baseline Requirements effective-date list.
The 100-day and 47-day dates are the effective-date lines in Baseline Requirements 2.2.7. A later BR revision can renumber the PDF. Re-check the current Baseline Requirements if this card is older than its last-verified date.
Sources
CA/Browser Forum TLS Baseline Requirements 2.2.7, section 6.3.2 effective dates