Beginning March 15, 2026, all publicly trusted Certificate Authorities must comply with new industry requirements that shorten the maximum validity period of SSL/TLS certificates to 6 months. These changes also affect how long domain validations (DCV) can be reused.
Article update (March 19):
This article was updated to reflect recent changes to our platform. ZeroSSL no longer offers single 1‑year certificate issuances. Instead, Annual Certificates are available, which provide one year of coverage through multiple certificate issuances in line with current industry requirements.
The new rules (Ballot SC-081v3) apply industry‑wide and are designed to strengthen web security by reducing the lifespan of certificates and domain validation records.
What Is Changing?
Maximum Certificate Validity Reduced to 200 Days
Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days. This reflects a shift from the previous 1‑year validity model to a shorter, more secure lifecycle.
DCV Reuse Limited to 199 Days
Domain Control Validation records can now be reused for only 199 days. Any DCV records older than this will be invalid and new records have to be created. Certificates will not be issued using domain validation records older than 199 days after the enforcement date.
Why These Changes Matter
The shortened certificate lifetime improves security by:
- Minimizing the risk of compromised private keys
- Reducing the time window in which a compromised certificate could be exploited
- Ensuring domain ownership is re-validated more frequently
- Minimizing long‑term reliance on older validation data
As a result, you should expect:
- More frequent certificate renewals
- More frequent DCV checks
- Possible early re-validation of domains validated before late 2025
- Re-issuance requirements for certificates tied to older DCV records
What Stays the Same
- Existing certificates remain valid until their original expiration date.
- Annual Certificates can be issued the same way 1-year certificates were being issued, however, every new certificate follows the new 200‑day limit and requires a mid‑term reissuance to cover the full 1-year period.
How This Affects ZeroSSL Plans
With the new 200‑day limit:
- Annual (formerly 1-year) certificates will include multiple certificate issuances throughout the term
- 30 days before a certificate expires you should get back the credits to issue a replacement certificate
- DCV must be valid at the time of each issuance, meaning domains must be re-validated earliest 30 days before expiration and their maximum lifetime is 200 days
Frequently Asked Questions
No. Existing certificates will remain valid until their current expiration date. The new limits apply only to certificates issued after March 15, 2026.
Need Help?
If you have questions about how these changes impact your ZeroSSL setup, our support team is here to help. We will continue to provide updates and resources as the industry transition moves forward.