How Long Do SSL Certificates Last? Validity in 2026 and the Road to 47 Days

The official timeline (CA/Browser Forum Ballot SC-081)

Domain validation (DCV) reuse periods shrink on the same schedule, and at the final step reuse drops to just 10 days. Renewal stops being an annual chore and becomes a continuous process: at 47 days, every certificate renews roughly eight times a year.

Why lifetimes keep shrinking

• Smaller blast radius: a compromised key or mis-issued certificate is only usable for weeks, not a year.
• Forced automation: short lifetimes make manual renewal impractical, which drags the whole ecosystem onto ACME and managed issuance.
• Faster agility: weak algorithms and compromised practices phase out in weeks instead of lingering for a year in the wild.

What breaks if you do nothing

The failure mode is simple math. With yearly certificates, a broken renewal cron had months of slack before anyone noticed. With 200-day certificates that slack is weeks; with 47-day certificates it is days. Add Let's Encrypt ending expiry reminder emails, and “we'll notice in time” stops being a plan — read why expiry emails were never enough and what an expired certificate actually breaks.

How to prepare in an afternoon

• Automate issuance with ACME wherever possible (certbot, Caddy, Traefik, or your CDN's managed certs). Manual CSR workflows are the first thing to kill.
• Inventory every certificate, including staging hosts, internal tools, and forgotten subdomains — those expire first.
• Monitor independently of issuance: automation fails silently. Daily expiry checks with 60/30/14/7/1-day alerts catch the failures ACME won't tell you about.

Spot-check where you stand today: run any domain through the free SSL checker to see its remaining lifetime, then put it on continuous monitoring.