SSL Certificates Now Last 200 Days: What It Means for Your Website

Facts checked against the CA/Browser Forum's rules, Let's Encrypt, Google and three UK hosts' own pages on 24 October 2026. We will update this page as the next changes land.

Do SSL certificates really only last 200 days now?

Yes. Since 15 March 2026, a new SSL certificate can last 200 days at most, down from 398. The limit drops again to 100 days in March 2027 and to 47 days in March 2029.

For most small business websites nothing breaks, as long as the certificate renews by itself. It just renews more often. The sites that get caught out are the ones where someone installs the certificate by hand, or where the automatic renewal has quietly stopped working and nobody is told. October 2026 added three more changes: Let's Encrypt is moving to 64-day certificates, Chrome now asks visitors before opening a site without HTTPS, and Chrome is removing one certificate company's root.

Key takeaways

• A certificate issued on or after 15 March 2026 can last 200 days at most. From 15 March 2027 the limit is 100 days, and from 15 March 2029 it is 47 days.
• If your host or platform renews your certificate automatically, you don't need to do anything.
• If you pay for a yearly certificate, you still pay once a year, but the certificate is reissued during the year. IONOS, Heart Internet and UK2 all say so on their own sites.
• If you or your developer install a certificate by hand, that now has to happen at least twice a year. Move to automatic renewal before the limit drops again.
• Let's Encrypt, the free certificate company, moves from 90-day to 64-day certificates on 10 February 2027. It stopped sending expiry reminder emails in June 2025.
• Google said on 21 October 2026 that Chrome now asks visitors for permission before opening a site without HTTPS, for all users by default.

What changed on 15 March 2026?

An SSL certificate is what gives your site its https:// address and the padlock. In Google's words, these certificates "encrypt the link between a site and your browser". The rules for publicly trusted certificates are set by the CA/Browser Forum, a group of certificate companies and browser makers, in its Baseline Requirements. The current version, 2.3.1, dated 4 October 2026, sets these limits:

The last column matters as much as the second. Before issuing a certificate, the certificate company has to check that you control the domain. By 2029 that check can only be reused for 10 days, so in practice it has to be done again for every certificate. Nobody can do that by hand every few weeks, so it has to be automatic.

Certificates issued before 15 March 2026 keep running to their normal end date. Heart Internet explains the reason simply: "If a certificate or encryption key were ever compromised, a shorter lifetime limits how long it could be used. It also encourages better automation and more frequent verification."

Does this affect my website?

It depends on who installs your certificate.

Your host or platform does it automatically. Nothing changes for you. IONOS, for example, answers "What do I need to do?" for its managed customers with "Nothing", and says its systems "automatically issue and install a new 180-day certificate on your website before the old certificate expires".

You bought a yearly certificate from your host. You keep paying once a year, but one certificate can no longer cover the year, so it is reissued partway through. The three UK hosts we checked all describe this:

Notice the condition in the Heart Internet and UK2 lines. The automatic reissue relies on the host being able to prove you control the domain, usually with a DNS record. If your domain's DNS sits with a different company, ask your host whether the mid-year reissue still happens by itself.

You or your developer install the certificate by hand. This is the case that changes most. IONOS tells customers who manage their own servers: "you must now replace the certificate files every six months instead of every twelve months". From March 2027 that becomes roughly every three months, and from March 2029 every six or seven weeks. IONOS points people to ACME, the standard way for a server to request and install certificates automatically. If anything on your site still has a certificate installed by hand, change that before March 2027.

Why do automatic renewals stop working?

Automatic renewal is reliable when it's set up properly, but it can fail without anyone noticing. Vercel, the host we use for the sites we build, lists what to check in its own help pages:

• The domain's settings have changed. The domain has to stay correctly set up so the host can complete the check. A DNS change or a proxy in front of the site can stop it.
• A CAA record blocks the certificate company. A CAA record is a DNS setting that says which certificate companies may issue certificates for your domain. If it doesn't allow the one your host uses, renewal can fail.
• The certificate was uploaded by hand. Vercel says it "cannot automatically renew certificates that you upload yourself".
• The domain itself lapsed. Vercel points out that certificate renewal "is separate from renewing the domain's registration".

The other change to know about: Let's Encrypt, whose free certificates Vercel uses for our sites, stopped sending expiry reminder emails on 4 June 2025. If an automatic renewal breaks, there may be no email to warn you before visitors start seeing errors.

What your visitors see when a certificate runs out

They don't see your site. In Chrome, they get a full-page warning headed "Your connection is not private". The details say the server "could not prove" it is your site, because its security certificate expired a number of days ago. IONOS warns its customers that visitors "will see a warning message such as 'Not secure' (e.g. ERR_CERT_DATE_INVALID)".

Some visitors will blame their own device. Chrome's help pages tell people who see NET::ERR_CERT_DATE_INVALID to check their device's date and time. Either way, your contact form, booking page or shop is out of reach until the certificate is fixed.

How to check your own certificate

1. In Chrome on a computer, open your website and select the icon to the left of the web address.
2. Select "Connection is secure", then "Certificate is valid". The certificate shows who issued it and when it expires.
3. Look at the expiry date. Automatic renewals usually happen well before the end: Vercel renews 14 to 30 days before a certificate expires, and Let's Encrypt suggests renewing at about two-thirds of a certificate's life. If yours has only a week or two left and hasn't been replaced, ask your host or developer now.
4. Ask your host three questions: does my certificate renew by itself, does that rely on you managing my DNS, and who is told if a renewal fails?

For example, we checked our own site on 24 October 2026. Its certificate was issued by Let's Encrypt on 15 September 2026 and expires on 14 December 2026: 90 days. Vercel automatically tries to renew it 14 to 30 days before then.

Three more changes in October 2026

Let's Encrypt moves to 64-day certificates

On 7 October 2026, Let's Encrypt announced that from 10 February 2027, "all Let's Encrypt subscribers will move to certificates with 64 day lifetimes by default". It expects the last 90-day certificate to expire on 11 May 2027, and the default drops again to 45 days on 16 February 2028. If your renewals are automatic, this should pass without you noticing. Let's Encrypt's advice to anyone whose renewal is set for a fixed number of days before expiry is to change it to renew "at approximately ⅔ of the lifetime instead".

Chrome now asks before opening sites without HTTPS

On 21 October 2026, Google said Chrome now "explicitly asks users for permission before making an insecure HTTP connection". It first switched this on earlier in the year for people using Chrome's Enhanced Protection, "and now we extended this protection to all users by default". Chrome's help pages describe the warning as "Your connection to this site is not secure". So a site that only works on http:// now greets Chrome users with a warning before it loads. If yours has no certificate at all, this is the change to act on.

Chrome removes an eMudhra root certificate

Google said on 20 October 2026 that Chrome is removing the "emSign ECC Root CA - G3" root certificate, run by the certificate company eMudhra, after some of its intermediate certificates were compromised. The removal is expected on the morning of Tuesday 27 October 2026, US Pacific time. Chrome's root programme counted about 30,800 unexpired certificates linked to that root, and 30,791 of them (99.9%) were issued through InCommon. For a UK small business this is very unlikely to matter. If your certificate's "issued by" line names eMudhra or emSign, contact your host today.

Watch out for renewal scam emails

Expiry dates make a good hook for scammers. Your certificate company may genuinely email you: Heart Internet and UK2 both say you might get an automated email from the certificate issuer, and UK2 says it "almost never requires a response". Be wary of any message saying your site will go offline unless you act now. In September 2026 a fake email aimed at our clients, sent from a Gmail address made to look like ours, had the subject "Important Domain Renewal Notice" and claimed the domain had to be renewed before 28 September or the site would go offline. It wasn't from us. If an email asks you to renew, pay or click a link to keep your site online, log in to your host yourself or call them on a number you already have. Forward suspicious emails to report@phishing.gov.uk (GOV.UK). How we contact our clients is set out on How we contact you.

If you'd rather not think about certificates at all

On the sites we build and run, certificates are part of the service. Every WebsiteCare plan includes SSL management, along with managed hosting, security monitoring, backups and updates, and every pay monthly website plan includes an SSL certificate. Our How we build page says no client has ever been asked to "install an SSL". Shorter certificates don't change that, because our host renews them automatically.

Want to know where your site stands? The £149 Full Website Audit from our Website Audit page includes a technical health check of hosting and security, and the fee is credited back if you then start a project with us. The free Mini Audit looks at your homepage, mobile and speed and basic SEO, so it is not a certificate check.

Thinking of a new site? Our 7 Day Website starts from £1,200, run on WebsiteCare from £65 a month, or our pay monthly plans are a free build from £30 a month. Either way we run the site for you, and because the site is part of the service, it comes down if you cancel. If your current site is on WordPress or another platform we didn't build, it isn't part of our standard WebsiteCare plans: we review the site and its hosting first, then give you a quote.

Frequently Asked Questions

Is my SSL certificate now only valid for 6 months?

Roughly, yes. A certificate issued on or after 15 March 2026 can last 200 days at most, which is about six and a half months, and IONOS now issues its certificates for 180 days. Some are shorter still: Let's Encrypt's are 90 days by default. A certificate issued before 15 March 2026 runs to its normal end date.

Is an SSL certificate valid for 199 days?

It can be. The rules say a certificate issued now "SHOULD NOT" last more than 199 days and "MUST NOT" last more than 200, so some certificate companies stop at 199. DigiCert, for example, says a reissued certificate's validity "cannot exceed 199 days".

Will I pay more for my SSL certificate?

Not at the hosts we checked. IONOS answers "Will this increase the price of my SSL subscription?" with "No. Your billing cycle remains unchanged", and UK2 says your subscription stays annual. What changes is that the certificate is reissued during the year. We only read three hosts, so check with yours.

What happens when an SSL certificate expires?

Visitors see a full-page warning instead of your site. In Chrome it reads "Your connection is not private", and the details say the certificate has expired. Your forms, bookings and checkout are out of reach until a new certificate is in place.

How long will SSL certificates last in 2027 and 2029?

100 days for certificates issued from 15 March 2027, and 47 days from 15 March 2029. Let's Encrypt is moving on its own timetable: 64 days from 10 February 2027 and 45 days from 16 February 2028.

Does Chrome block websites without HTTPS?

It asks first. Google said on 21 October 2026 that Chrome now asks users for permission before opening an insecure HTTP connection, for all users by default. A site with no certificate now shows Chrome users a warning before it loads.

Do I need to worry about eMudhra?

Very unlikely. Chrome is removing one eMudhra root certificate on 27 October 2026, and 99.9% of the certificates linked to it were issued through InCommon. If your certificate's "issued by" line names eMudhra or emSign, contact your host straight away.

Related reading

• What Does It Cost to Run a Website Each Year in the UK?
• Website Security Checklist for Small Businesses
• How Much Does Website Downtime Cost Your Business? (UK Data)
• PHP Security Update: What to Do When a Critical Flaw Hits Your Website (October 2026)
• Complete Guide: Website Hosting & Maintenance: What Every Business Needs to Know