TLS certificates: 100 days from March 2027 — who renews?

Certificate lifetimes are shrinking on a published schedule. The CA/Browser Forum Baseline Requirements, which every publicly trusted CA follows, cap the validity of a subscriber certificate at 200 days since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Let's Encrypt is moving on its own timeline within that.

The dates

Date	What changes	Source
Mar 15, 2026	Max validity 200 days (any public CA)	CA/B Forum BR 6.3.2
May 13, 2026	Let's Encrypt tlsserver profile issues 45-day certificates (opt-in)	Let's Encrypt
Feb 10, 2027	Let's Encrypt default classic profile: 64-day certificates, 10-day authorization reuse	Let's Encrypt
Mar 15, 2027	Max validity 100 days (any public CA)	CA/B Forum BR 6.3.2
Feb 16, 2028	Let's Encrypt classic: 45-day certificates, 7-hour authorization reuse	Let's Encrypt
Mar 15, 2029	Max validity 47 days (any public CA)	CA/B Forum BR 6.3.2

The new limits apply to certificates issued after each date, so you meet them at your next renewal.

Find what you have

Illustrative example.

# expiry and issuer of what a host actually serves
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -issuer -enddate

# certificates managed by certbot on this host
sudo certbot certificates

# fixed-interval renewals hiding in cron
grep -rn "renew" /etc/cron* /var/spool/cron 2>/dev/null

When to renew

Let's Encrypt recommends ACME Renewal Information (ARI), or renewing at about two thirds of the current certificate's lifetime, and says a hardcoded 60-day interval will no longer be enough. Illustrative arithmetic: a 64-day certificate → renew around day 42; a 100-day certificate → around day 66.

Important. The ACME client on the web server is rarely the problem. The usual misses are the places where a certificate is copied by hand: load balancers, CDN and WAF uploads, appliances, a partner's allow-list, a mobile app with pinning. Each of those needs a named owner and a reminder that fires before expiry, not after.

Checklist

• ☐ List every public certificate: host, issuer, expiry, how it is renewed
• ☐ Renewals driven by ARI or by lifetime ratio, not a fixed 60-day timer
• ☐ Manual copies (LB, CDN, appliances) marked, with one accountable person each
• ☐ Expiry monitoring with an alert at least a week ahead
• ☐ Staging run against a short-lived profile before February 10, 2027

One accountable person per certificate

A RACI matrix forces the question nobody asks until the outage: who is Accountable for each renewal, who does it, who must be told. The sheet checks that every row has exactly one A.

Open the RACI matrix →

Sources: CA/Browser Forum, Baseline Requirements for TLS Server Certificates, section 1.2.2 (Relevant Dates) and 6.3.2; Let's Encrypt, "Decreasing Certificate Lifetimes to 45 Days" (December 2, 2025).