SSL certificates drop to 100 days in March 2027: date calculator

The schedule

These limits come from the CA/Browser Forum's Baseline Requirements (version 2.3.1, October 2026, section 1.2.2), which public certificate authorities must follow. They apply by the date a certificate is issued.

Issued on or after	Longest lifetime	Domain validation can be reused for	Renewals a year, at least
Before March 15, 2026	398 days	Longer, under older rules	1
March 15, 2026	200 days	200 days	2
March 15, 2027	100 days	100 days	4
March 15, 2029	47 days	10 days	8

Let's Encrypt runs on its own, shorter timetable. Its default certificates are 90 days today, 64 days from February 10, 2027 and 45 days from February 16, 2028, according to its December 2025 announcement. Providers can also issue a little under the limit, so read these as upper bounds.

Work out your own dates

Enter the day a certificate was or will be issued. This runs in your browser and sends nothing to us.

A worked example: one day's difference

A certificate issued on March 14, 2027 can last 200 days, until about September 30, 2027. One issued the next day, March 15, can last only 100 days, until about June 23, 2027. That's 99 fewer days for renewing a day later.

So renewing in early March gets you one last long certificate, if your provider will issue one. It only delays the change by a few months, and it doesn't help if the real trouble is that someone has to remember the renewal.

Who actually needs to do something

Your host or CDN renews for you: usually nothing to change. Most managed hosts do it automatically. It's still worth checking once that yours does, because a custom domain or an old manual upload can sit outside that automation.
An ACME client renews for you (Certbot and similar): check that it renews by how much life is left, not on a fixed monthly schedule. A job set to run every 60 days stops being safe when certificates last less than that.
A person buys, downloads and installs it: this is the group the change hits. Expect at least four renewals a year per certificate from 2027. Devices are often in this group too: firewalls, load balancers, mail servers and other equipment with a certificate uploaded by hand.
Multi-year purchases: a multi-year plan can still be sold, but it's a subscription to reissues. You still have to install each shorter certificate.
Internal certificates from your own private authority: these rules are for publicly trusted certificates, so they don't apply directly.

A 30-minute check for each client or company

List the hostnames, not just the main domain. The ones that get missed are mail., vpn., portal., shop. and staging sites. Public Certificate Transparency logs help here: searching them for your domain lists names that have had certificates issued.
Check each one above. Note the expiry date and who issued it.
Mark how each renews: automatic, or by hand. If nobody knows, treat it as by hand.
Sort the by-hand list by expiry date, and move what you can to automatic renewal before March.
Keep a monitor on what's left. Automatic renewal fails quietly: a changed DNS record or a closed port can stop it, and you find out when the site breaks.

What this check can and can't see

The check above makes a live HTTPS connection to see whether the site's certificate is trusted, and reads the expiry date from public Certificate Transparency logs. The date is for the newest certificate logged for that name. If a renewed certificate was issued but never installed, the logs can show a later date than the site is actually serving. A failed connection shows up once the installed certificate expires.

Domain Health's Agency and higher plans repeat the check on your monitored domains and alert you before expiry and if HTTPS stops working.