20250422 - SSL Certificate Lifetime Limitation
The CA/B Forum voted a few days ago to limit the lifespan of SSL certificates.
As a reminder, the maximum lifespan today is 398 days, or 1 year and 1 month.
What is the schedule?
The reduction in the lifetime of SSL certificates will be done in stages to reach 47 days in 2029.
- From March 15, 2026, the maximum lifespan will decrease to 200 days.
- From March 15, 2027, the maximum lifespan will decrease to 100 days.
- Finally, from March 15, 2029, the maximum lifespan will decrease to 47 days.
Case of DigiCert certificates
DigiCert will cease issuing 397-day valid SSL certificates as of February 24, 2026. This applies to all new orders, renewals, and reissues of DigiCert, Thawte, and Geotrust DV, OV, and EV SSL certificates. From February 24, 2026, SSL certificates issued by the authority will be limited to a maximum validity of 199 days.
Case of Sectigo certificates
Sectigo will cease issuing 397-day valid SSL certificates as of March 12, 2026. This applies to all new applications, renewals, and reissues of DV, OV, and EV SSL certificates. From February 12, 2026, SSL certificates issued by the authority will be limited to a maximum validity of 199 days.
What are the consequences for certificates issued before the deadlines?
None. These certificates will remain valid until their expiration date.
Cases of reissuances issued after the deadline
Certificates that are reissued after the deadlines will have to comply with current standards and will therefore have a reduced lifespan.
They will then have to be reissued again to reach the initial expiry date (the certificate will then switch to a plan management type).
Consequences for ongoing plans
Your reissuances schedules will be updated to reflect the current maximum durations.
The validity dates of your plans will remain unchanged, so no loss of days is expected.
How to anticipate these developments
Firstly, we advise you to order as many certificates valid for 1 year as possible before the deadline.
Automation
Eventually, managing a large fleet of certificates manually will become very restrictive, if not impossible.
So it's time to get started using the various automation tools we offer.
There are several:
- Enabling automatic renewals and/or reissuances: Once this option is enabled, our tools will submit renewal or reissue requests for any expiring certificate for you.
- TBSCertBot: A command-line tool that lets you manage your certificate orders, from private key generation to installation and renewal. It offers automated orders and renewals using hooks and cron mode.
- ACME: DigiCert allows you to use the third-party ACME client of your choice to automate obtaining your certificates.
- Sectigo SCM: Sectigo Certificate Management is a CA-agnostic platform designed to issue and manage the lifecycles of all public and private digital certificates. SCM offers automatic discovery of all certificates distributed throughout the organization and is capable of authenticating and securing every human and machine identity in the enterprise.
All of these offers have been available for several months, or even years. The only prerequisite is the creation of a Certificate Center.