SSL certificate lifetime: the 200, 100 and 47-day timeline

Public TLS certificate lifetime schedule

As of November 3, 2026, the CA/Browser Forum baseline requirements set the following maximum validity for newly issued publicly trusted TLS server certificates. Issuers can use shorter lifetimes. Existing certificates are not automatically shortened solely by these dates; revocation or other events can affect them.

Source: CA/Browser Forum TLS Baseline Requirements. These limits cover publicly trusted TLS server certificates; private PKI may follow different policies. A yearly subscription can require multiple reissues and deployments.

Let’s Encrypt: 90, then 64, then 45 days

Let’s Encrypt announced that its default moves from 90 to 64 days for certificates issued or renewed from February 10, 2027, unless a shorter profile is selected. It plans a 45-day default on February 16, 2028. Some shorter profiles are already available. Check the 64-day announcement and upcoming features for updates.

What teams should do now

• Inventory endpoints and owners, including CDN edge and separately reachable origins.
• Use an ACME client that supports Renewal Information (ARI) where available; otherwise follow issuer guidance and avoid hard-coded renewal dates.
• Test staging issuance and domain validation; verify certificate deployment and service reload.
• Set independent expiry alerts and an escalation owner. Ensure reminder windows fit shorter lifetimes.
• After renewal, inspect the certificate actually served to users.

Does Certimon renew certificates?

Certimon monitors the publicly served certificate and sends expiry alerts; it does not issue or renew the certificate. Use your CA or ACME client for renewal and verify that your infrastructure deploys it. Check a public certificate and review watched domains.

Related: certificate lifetime timeline · renewal guide · free certificate monitoring