What's changing
The CA/Browser Forum — the group of certificate authorities and browser makers that sets the rules every public TLS certificate has to follow — is phasing maximum certificate lifetimes down in stages: 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029. After each date, no publicly trusted certificate authority can issue a certificate longer than the new cap, for anyone.
Why it's happening
A shorter-lived certificate has a shorter window to do damage if something goes wrong with it — a misissuance, a compromised private key, an outdated domain validation record. It also forces something the industry has wanted for years: certificate renewal that's automated rather than manual, since nobody is going to reissue a certificate by hand every 47 days at any real scale.
What breaks if you're not ready
Nothing breaks on 15 March 2027 itself for a certificate already issued before then — existing certificates keep running until their own expiry. What breaks is the next renewal: a certificate authority simply won't issue a 200-day or 398-day certificate anymore. Any renewal process built around long lifetimes and manual issuance stops working at exactly the moment it's relied on.
How to be ready
The fix is the same regardless of how much lifetime is left: move to an automated ACME client — Certbot, acme.sh, or built-in support from your hosting platform or load balancer — issuing from Let's Encrypt, ZeroSSL, Google Trust Services or Buypass. Once renewal is automated, a shorter maximum lifetime stops being something to plan around.
See where you stand
SUN-DRAM Scanner reads a certificate's actual lifetime and issuer, and gives a direct verdict — automated, possibly automated, or manual — on whether a hostname is already ready for this change. See the full countdown and all three phase dates, or scan a hostname below.