The padlock in your website's address bar is there thanks to an SSL (TLS) certificate. The CA/Browser Forum, which brings together browser makers and certificate authorities, has decided to cut the maximum validity of these certificates in stages. The change applies to every website — a big portal and a one-page brochure site alike.
The timeline
- From 15 March 2026 — newly issued certificates will be valid for at most 200 days (previously 398);
- From 15 March 2027 — at most 100 days;
- From 15 March 2029 — at most 47 days.
In parallel, the period during which a certificate authority can reuse an earlier check of your domain ownership is also getting shorter. In other words, domain ownership will be checked more often when the certificate is renewed.
What does an SSL certificate do?
A certificate does two jobs: it encrypts the connection between visitor and site (passwords, card details and form text can't be read in transit), and it confirms to the browser that the site really belongs to that domain. On a site with no certificate or an expired one, the browser shows a full-screen warning, and most visitors turn back.
Why is this happening?
If a short-lived certificate is stolen or mis-issued, the window for abusing it is short too. Frequent renewal also pushes companies to automate the process — which removes the risk of forgetting a manual renewal. That's exactly the most common problem with long-lived certificates: a year later, nobody remembers to renew.
What changes for a website owner?
If you buy and install your certificate by hand once a year, that will stop being practical: by 2029 you'd have to do it about 8 times a year. And when a certificate expires, visitors see a red warning screen instead of your site, online payments stop, and mobile apps and API integrations start throwing errors.
Free vs paid certificates
In terms of encryption there's no difference: free certificates like Let's Encrypt are just as trustworthy as paid ones and were designed for automatic renewal from the start. Paid certificates are mainly chosen when a legal check of the company (OV/EV) or special warranty terms are needed. For the vast majority of small and medium business sites, a free, automatically renewed certificate is enough.
What should you do?
- Make sure certificates renew automatically (for example, with Let's Encrypt or your hosting panel's automatic SSL feature);
- If you use paid certificates bought by hand, ask your provider about automation options;
- Set up an alert that tracks the certificate's expiry date;
- Check that every page of your site opens over https and that http addresses redirect to https;
- If your domain's DNS goes through a service like Cloudflare, check that the SSL mode is set correctly there too.
How can I check?
Open your site in a browser and click the padlock (or settings) icon in the address bar → "Connection is secure" → "Certificate". You'll see who issued the certificate and when it expires.
If you don't know whether your site's certificate renews automatically, write to us — we'll check and set up automation if needed. More: Keeping track of domain and SSL expiry.
