Contents
Under ballot SC-081v3 of the CA/Browser Forum, the joint body of browser vendors and certificate authorities, the maximum validity of publicly trusted SSL/TLS certificates dropped from 398 days to 200 days on 15 March 2026. The schedule continues: lifetimes shrink step by step to 47 days.
The timeline
| Date | Maximum validity | Domain validation reuse |
|---|---|---|
| Until 15 March 2026 | 398 days | 398 days |
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
The rule binds only certificate authorities trusted by browsers; private, internal CAs can keep issuing for any period. Multi-year purchases are still paid once, but the certificate is reissued within these limits.
What it means for site owners
- A manually installed certificate has to be renewed twice a year instead of once, four times a year after 2027 and eight times after 2029.
- Because the reuse period for domain validation shrinks too, validation by DNS record or HTTP file has to be automated for every renewal.
- A missed renewal means visitors see a full-page "your connection is not private" warning. On a checkout page that is lost revenue.
How automatic renewal works at Fiberserver
On cPanel hosting accounts a free SSL certificate is installed automatically for every domain and renewed by the server before it expires; validation happens through your account, so there is nothing for you to do. As long as your domain's DNS points to our server, the cycle runs on its own.
For OV and EV certificates that display your organisation, and for wildcard certificates, shorter lifetimes mean more frequent reissues. We send renewal reminders for these certificates and our support team handles reissue and installation; once the organisation has been validated, renewals do not ask for the documents again.
If you run a VDS or a dedicated server you manage the certificate yourself. We recommend setting up certbot or acme.sh with an ACME-capable authority such as Let's Encrypt and enabling automatic renewal now; the steps are in our VDS security guide. If the server runs cPanel/WHM, AutoSSL does the same job.
What to do now
- Check your certificate's expiry date (padlock icon in the browser → certificate).
- If the certificate was installed by hand, switch to automatic renewal or move the account to hosting where free SSL renews itself.
- With many hostnames, consolidate management with a wildcard or multi-domain (SAN) certificate.