Starting February 24, 2026, all Certification Authorities (CAs) will begin issuing TLS/SSL certificates with a maximum validity of 199 days, down from the current 397 days.
This is not a vendor-specific decision, but an industry-wide requirement mandated by the updated Baseline Requirements of the CA/Browser Forum. The primary objective is to strengthen overall internet security by reducing the exposure window of compromised certificates and enabling faster adoption of new cryptographic standards as threats evolve.
Why Certificate Lifetimes Are Getting Shorter
Shorter certificate validity periods bring several security and operational advantages:
- Reduced risk in case of private key compromise
- Faster response to vulnerabilities and cryptographic deprecations
- Improved alignment with modern automation-driven certificate management
This change follows the same security-first approach that previously led to the reduction from multi-year certificates to one-year certificates.
CA Cutoff Dates
Different Certification Authorities will enforce the new 199-day maximum validity on different dates:
- DigiCert – February 24, 2026
- Sectigo – March 14, 2026
After these dates, any newly issued or reissued certificate will comply with the 199-day limit.
How to Handle Shorter SSL Certificates: Two Available Approaches
With reduced certificate lifetimes, there are two practical ways to manage renewals and reissues.
Option 1 – Manual Re-Issuance
You can continue purchasing SSL certificates exactly as you do today (for example, 1-year or 2-year products). However, you will need to reissue and reinstall the certificate approximately every six months.
Key points:
- No additional cost for reissues
- Requires operational attention
- Re-issue notifications should be enabled in your account to avoid service interruptions
This approach is suitable for low-volume environments or organisations with established manual procedures.
Option 2 – Switch to Certificate Automation (Recommended)
Automation removes the operational burden of frequent reissues and virtually eliminates the risk of certificate expiration.
Over the coming weeks, EuroSSL will introduce multiple automation options, including:
- Subscription SSL with automatic installation for Apache, NGINX, and Microsoft IIS
- ACME-based SSL certificates for fully automated issuance and renewal
- Auto-reissue support for AutoInstall SSL integrations with cPanel, Plesk, and DirectAdmin
Once configured, certificates are reissued, installed, and renewed automatically—without manual intervention.
Prepare Now for the 199-Day SSL Era
The transition to shorter-lived TLS certificates is inevitable and already scheduled. Organisations that plan— especially by adopting automation — will benefit from improved security, reduced risk of downtime, and lower operational overhead.
If you need guidance on choosing the right SSL solution or enabling automation, the EuroSSL team is ready to help you prepare well before the 2026 deadlines.
