Short answer: yes, SSL/TLS certificates are getting much shorter lives. The 1-year (398-day) certificate ended on 15 March 2026. Today the maximum is 200 days (about 6½ months). From 15 March 2027 it drops to 100 days (about 3 months), and from 15 March 2029 to just 47 days.

The change comes from CA/Browser Forum Ballot SC-081, approved in April 2025. Every public Certificate Authority — DigiCert, Sectigo, GlobalSign, GeoTrust, Thawte, RapidSSL, eMudhra and others — must follow it. Browsers such as Chrome, Safari, Firefox and Edge will not trust certificates that break these limits.

SSL certificate validity timeline

Why are certificate lifetimes being reduced?

• Less damage from stolen keys: a compromised certificate stops working sooner.
• Fresher validation: domain ownership and company details are checked more often, so stale or wrong data does not stay in use for a year.
• Revocation is unreliable: browsers do not always check revocation, so short expiry is the safer cut-off.
• Push towards automation: the industry wants renewals handled by tools (ACME, auto-install, monitoring) instead of manual yearly work.

Do I still buy a 1-year or multi-year SSL plan?

Yes. You can still buy 1, 2 or 3-year SSL subscriptions. What changes is the certificate inside the plan: it is issued for a shorter period and reissued free of cost before it expires, for the whole subscription. You pay once for the plan term; you reinstall (or auto-install) the new certificate each cycle.

What this means for Indian businesses

• More renewals per year: about 2 installs a year now, about 4 from March 2027, and roughly 8 from March 2029.
• Expiry risk goes up: one missed reinstall means a browser “Not Secure” warning, failed payment gateway checks (Razorpay, PayU, CCAvenue, bank APIs), broken mobile apps and lost customer trust.
• OV and EV need planning: organisation details are rechecked, so keep your company documents, GST/registration and contact numbers current.
• Every server counts: load balancers, mail servers, cPanel/Plesk hosting, Tomcat/IIS, firewalls and CDNs each need the new certificate.

How to prepare: a simple checklist

1. List every certificate you use — domain, server, expiry date and who manages it.
2. Turn on automation where possible (ACME clients such as Certbot, hosting panel AutoSSL, or your CA’s auto-install agent).
3. Set up expiry monitoring with alerts well before the expiry date.
4. Keep validation ready: make sure DNS or email/HTTP validation for your domains works quickly.
5. Choose a multi-year plan so reissues are already paid for and you are not re-buying every few months.
6. Check after each install that the full certificate chain and hostname are correct.

How SSL Firm helps

• Branded SSL from trusted CAs — DigiCert, Sectigo, GlobalSign, GeoTrust, Thawte, RapidSSL and eMudhra, with 1–3 year plans and free reissues.
• Free SSL tools — decode your CSR and check live installation from our SSL Tools page.
• Expiry monitoring — get alerts before a certificate runs out.
• Installation support — our team can install and verify each reissued certificate on your servers.

Need help planning for 100-day certificates? Call Sales on +91 95 8290 7788 or email sales@itmonteur.net. For existing orders, call Support on +91 94 8585 7788.

Source: CA/Browser Forum TLS Baseline Requirements, section 6.3.2 (maximum validity) and section 4.2.1 (validation data reuse), as amended by Ballot SC-081v3.

The post SSL Certificate Validity Reduced-200-100-47-days first appeared on SSL Cerificate.

The post SSL India first appeared on SSL Cerificate.

The post SSL Certificate in India first appeared on SSL Cerificate.