SSL Certificates: The 200-Day Limit in 2026 and the Path to 47 Days

What Ballot SC-081 Changes in Practice

Ballot SC-081 was passed by the CA/Browser Forum in April 2025 and defines a phased reduction plan for the maximum validity of public SSL/TLS certificates (CA/Browser Forum). The vote passed with an overwhelming majority — 28 certificate authorities voted in favour, none against. Apple, Google and Mozilla as browser vendors also voted unanimously in favour.

Particularly relevant is the separate reduction of Domain Control Validation (DCV): from 2029, domain ownership must be re-confirmed every 10 days. This makes manual renewal practically impossible and forces ACME-based automation. Anyone not automatically monitoring their SSL status risks silent failures.

Why Shorter Lifetimes Improve Security

The CA/Browser Forum's reasoning is based on three security principles:

1. Faster key rotation: The shorter the lifetime, the more frequently the private key is renewed. If a key is compromised, the window for abuse is correspondingly shorter. With 47-day certificates, maximum exposure is less than 7 weeks instead of over a year.
2. Domain validation freshness: With long lifetimes, domain ownership can change while the old certificate is still valid. More frequent DCV ensures only the actual owner possesses a valid certificate.
3. Forced automation: Manual processes are error-prone. Short lifetimes force operators into automation (ACME), which is more reliable long-term than calendar-based reminders.

Let's Encrypt has successfully demonstrated this model with 90-day certificates since 2015. According to Let's Encrypt, over 380 million certificates are actively managed — nearly all fully automated via ACME (Let's Encrypt). The industry is now following this model with the phased reduction for all certificate authorities.

What the 200-Day Limit Means for European SMBs

For smaller businesses running their website through a hosting provider, little changes at first glance: most providers already use Let's Encrypt with 90-day lifetimes and automatic renewal. But there are numerous scenarios where the 200-day limit still becomes relevant:

• Paid EV/OV certificates: Anyone purchasing Extended Validation or Organisation Validation certificates from commercial CAs could previously buy 13-month lifetimes. Now the maximum is 200 days — annual costs effectively double, or the provider must switch to ACME.
• Multi-domain environments: Businesses with multiple domains, subdomains and wildcard certificates now face shorter renewal cycles across more certificates simultaneously.
• CDN and load-balancer setups: Certificates on CDN edge nodes and load balancers must be synchronised more frequently. A forgotten node with an expired certificate leads to intermittent errors.
• Mail servers and API endpoints: Websites aren't the only services using SSL. SMTP, IMAP and REST APIs also need valid certificates — and are frequently overlooked during renewal.

According to a Venafi study, approximately 83% of all unplanned outages in 2025 were attributable to expired certificates (Venafi). With increasing renewal frequency, this problem will grow without automated monitoring. XICTRAQ's uptime monitoring detects SSL-related outages immediately.

ACME Automation: What to Set Up Now

ACME (Automatic Certificate Management Environment, RFC 8555) is the standard protocol for automatic certificate renewal. Let's Encrypt popularised it, but commercial CAs such as DigiCert, Sectigo and GlobalSign now also offer ACME endpoints. Anyone still renewing certificates manually should switch to ACME now.

The most common ACME clients:

• Certbot: The best-known client, supporting HTTP-01 and DNS-01 challenges. The simplest solution for most Apache and Nginx servers.
• acme.sh: Shell-based client with no dependencies, particularly popular on shared hosting and in Docker environments.
• Caddy: This web server has ACME natively built in — certificates are automatically obtained and renewed without configuration.
• Plesk / cPanel: Both hosting panels offer integrated Let's Encrypt management. Check that automatic renewal is active and the cron job is running.

The Path to 47-Day Certificates: What's Coming by 2029

The 200-day limit is only the first stage. The CA/Browser Forum's full roadmap includes three further reductions (CA/Browser Forum, Ballot SC-081):

1. March 2027 — 100 days: The lifetime halves again. Quarterly renewal becomes the minimum. Manual management becomes impractical for most organisations from this point.
2. March 2028 — DCV to 30 days: Domain validation must be renewed monthly. Organisations still relying on manual DNS TXT records can no longer keep up.
3. March 2029 — 47 days, DCV to 10 days: The end goal. Certificates expire every 47 days, domain ownership must be confirmed every 10 days. Stable operations without ACME automation and continuous monitoring are no longer feasible.

In practical terms, this means: investing in automation and monitoring now prepares you for the next stages. Waiting means facing a significant transition in 2029. The 2026 security checklist includes additional measures to implement in parallel.

Setting Up SSL Monitoring as a Safety Net

Regardless of whether you use ACME or your provider handles renewal: automated SSL monitoring is the safety net that prevents a forgotten or failed certificate from taking your website offline. XICTRAQ SSL monitoring checks at configurable intervals:

Setup takes less than 2 minutes: add your website, configure notification channel, done. From the first check, you see the complete SSL status including certificate chain, TLS version and HSTS configuration. Anomalies are reported via alert.

Chrome and the HTTPS Mandate: Parallel Developments

In parallel with the shorter lifetime limit, browsers are also tightening their HTTPS requirements. Google Chrome plans to block websites without HTTPS by default from October 2026, rather than merely displaying a warning (Chromium Blog). Together with the shorter certificate lifetime, this creates a scenario where an expired certificate no longer just shows a warning but completely prevents access to the website.

For website operators, this has concrete consequences: an expired SSL certificate effectively becomes a total outage. While users could previously bypass the warning with two clicks, Chrome will make this significantly harder from 2026. Combined with performance monitoring, XICTRAQ detects when SSL problems affect load times, and with uptime monitoring, when the website becomes unreachable.

Cost and ROI: What SSL Monitoring Saves Compared to an Outage

An SSL outage has direct and indirect costs. According to a Gartner estimate, the average downtime cost for mid-sized enterprises is approximately USD 5,600 per minute (Gartner). Even if an SSL outage lasts only 30 minutes before it's detected and fixed, that's USD 168,000 in potential damage — not including SEO penalties and trust erosion.

The pricing for professional SSL monitoring is a fraction of this amount. Combined with XICTRAQ's comprehensive website monitoring, you get not just SSL oversight but also uptime, performance, security scans, GDPR compliance and analytics from a single platform. Detailed calculation examples can be found in calculating website downtime costs.

Checklist: How to Prepare for Shorter SSL Lifetimes

• Set up an ACME client: Install Certbot, acme.sh or use your hosting panel's integrated ACME management. Test automatic renewal manually at least once.
• Inventory all domains: Create a list of all domains, subdomains and wildcard certificates. Don't forget mail servers, API endpoints and staging environments.
• Activate SSL monitoring: Set up automated expiry warnings that notify at least 30 days before expiry. XICTRAQ offers tiered warnings at 30, 14 and 7 days.
• Configure HSTS: Set the Strict-Transport-Security header with a max-age of at least 31536000 (1 year) and includeSubDomains.
• Check TLS version: Disable TLS 1.0 and 1.1 on all servers. Only TLS 1.2 and 1.3 should be active.
• Create an incident plan: Document the process for manual certificate renewal in case ACME fails. A website incident plan is essential infrastructure.
• Review monitoring results regularly: Even automated systems need occasional checks. Verify monthly that all notification channels are working.

Frequently Asked Questions About the 200-Day SSL Limit