SSL certificates drop to 100 days in March 2027 (and 47 days after): why manual renewals will take your site offline

If your business still buys a commercial SSL certificate once a year from GoDaddy, 123 Reg, or Namecheap and pays someone to paste the `.crt` file into a server control panel, that habit already broke in spring and is about to get twice as painful. Under CA/Browser Forum Ballot SC-081v3, the maximum lifespan of a public SSL/TLS certificate dropped from 398 days to 200 days on 15 March 2026. On 15 March 2027, four months from now, it drops again to 100 days, before hitting its final floor of 47 days in March 2029.

When I look after a company site on my £49 a month website care plan or manage a Linux server, nobody touches a certificate renewal by hand. Yet every few weeks I still get a phone call on a Monday morning from a business owner whose website is throwing a full-screen “Your connection is not private” warning in Chrome and Safari because an annual calendar reminder was no longer annual.

The official SC-081v3 countdown for every website and API

Apple, Google, Mozilla, Microsoft, and every public certificate authority voted in favour of Ballot SC-081v3. Because browsers enforce these limits at the operating system level, you cannot buy your way around the calendar by switching certificate vendors. If a certificate authority issues a certificate that runs one day longer than the limit, Chrome and Safari simply refuse to trust it.

Alongside the shorter certificate lifespan, the ballot also shrinks the Domain Control Validation (DCV) reuse window. That is the rule governing how long a certificate vendor can remember that you own your domain before forcing you to prove it again via a DNS record or verification email:

Enforcement Date	Max Certificate Lifespan	Max Domain Validation (DCV) Reuse	Minimum Renewals Per Year (if done at 2/3 life)
Before 15 March 2026	398 days (~13 months)	398 days	Once a year
Since 15 March 2026 (Current)	200 days (~6.5 months)	200 days	2 to 3 times a year
15 March 2027 (In 4 months)	100 days (~3.2 months)	100 days	5 to 6 times a year
15 March 2029	47 days (~6.5 weeks)	10 days	11 to 12 times a year (every month)

Why paying £70 a year for a manual SSL certificate is now a liability

Ten years ago, buying a two-year or one-year Domain Validated certificate from a domain registrar made sense if you did not have a systems administrator. You clicked a verification link sent to `admin@yourdomain.co.uk`, downloaded a zip file, uploaded the certificate to cPanel, Plesk, or IIS, and forgot about it for twelve months.

Look at what happens to that workflow from 15 March 2027. Even if your registrar sells you a “one-year SSL subscription”, they are legally forbidden from handing you a 365-day certificate. Instead, they issue a 100-day certificate and expect you to re-validate your domain and install a replacement file every eighty or ninety days. By March 2029, the domain validation reuse window drops to ten days, meaning every single 47-day renewal requires a fresh domain ownership check within ten days of issuance.

If the person who receives that validation email is on holiday in August, or if your developer installs the new certificate on the main web server and forgets the subdomain running your quoting portal or mail server, your customers hit a padlock warning that looks identical to a man-in-the-middle attack.

Every host says certificates renew automatically, right up until they do not

The obvious fix is to stop buying manual certificates and use the ACME protocol (via `certbot`, `acme.sh`, or Caddy) with Let’s Encrypt or a commercial ACME endpoint. Let’s Encrypt has issued 90-day certificates from the day it launched, renewing them automatically every sixty days. For a server already running ACME cleanly, the March 2027 drop to 100 days changes nothing at all.

The catch is that automated renewal scripts fail quietly when the environment around them changes. When I audit a server where an automatic Let’s Encrypt renewal failed, it is almost always one of four things:

First, someone turned on Cloudflare proxy or changed an `AAAA` IPv6 record in DNS, breaking the `http-01` validation check sitting in `/.well-known/acme-challenge/`. The site kept working fine for two months until the old certificate expired.

Second, `certbot` renewed the certificate files on disk in `/etc/letsencrypt/live/` at two in the morning, but nobody added a `--deploy-hook "systemctl reload nginx"` command. Nginx carried on serving the old expired certificate held in RAM until someone manually reloaded the daemon.

Third, an old firewall rule or an end-of-life Linux distribution left an outdated `certbot` package on the box that could no longer talk to the CA’s current API endpoint.

Fourth, nobody was checking the certificate from the outside. Monitoring the file on disk tells you what is stored in a folder; monitoring the live TLS handshake from an external server tells you what a customer’s browser actually sees.

How to set this up once before March 2027

Whether you run one brochure website or five internal business portals, you only need to do three things before the 100-day limit lands in March.

Stop paying domain registrars £60 to £150 a year for manual `.crt` files that require human copy-pasting. Switch every public web server and reverse proxy to an automated ACME client (`certbot` or `acme.sh`), use DNS-01 API validation if the server sits behind a firewall or uses wildcard subdomains, and test the renewal pipeline right now with `certbot renew --dry-run`.

On my £49 a month Website Care Plan, automated renewal and external TLS expiry monitoring are built into the baseline. If a DNS change or an upstream hiccup ever stops a certificate from renewing thirty days before expiry, it flags on my desk weeks before a single visitor sees a browser warning.

Common questions

Will an SSL certificate issued before 15 March 2027 be cut short?
No. The SC-081v3 limits apply based on the date the certificate is issued. A certificate issued on 10 March 2027 can still run for up to 200 days. Any new or replacement certificate issued on or after 15 March 2027 is capped at 100 days.

Are paid SSL certificates any more secure than Let’s Encrypt?
No. A free Let’s Encrypt Domain Validated (DV) certificate uses the exact same 256-bit ECDSA or 2048-bit RSA encryption strength and is trusted by the exact same browsers as a £120 DV certificate from a commercial vendor. Modern browsers removed the green company-name bar for Extended Validation (EV) certificates years ago.

Does the 100-day and 47-day rule apply to internal private CA certificates?
No. Ballot SC-081v3 only governs publicly trusted TLS certificates chaining up to root authorities in browser trust stores (Apple, Google, Mozilla, Microsoft). Internal certificates issued by your own private Active Directory or WireGuard CA are not restricted by browser limits.

If you are still renewing SSL certificates by hand, or want your website and server looked after properly so an expired certificate never takes your site offline, take a look at my £49 a month Website Care Plan or Servers and Infrastructure work, or send me a message.