New SSL Certificate Rules: Validity, Subscription and Reissue Udskriv

The short version

Since March 15, 2026, any public SSL certificate can be issued for no more than 200 days. In practice, certificate authorities issue them for 199 days. Before this, a certificate could be valid for up to 398 days.

• You still pay for a certificate for one year (or several years). The only difference is that within this period the certificate has to be reissued, roughly every six months.
• Reissuing within the paid period is free of charge.
• Certificates issued before March 15, 2026 stay valid until their original expiry date. Nobody shortens them.
• It will get shorter: 100 days from March 2027 and 47 days from March 2029. So it is worth thinking about automatic installation now.

What changed and why

In April 2025, the CA/Browser Forum (an association of certificate authorities and browser developers) adopted ballot SC-081v3. All major browsers voted for it: Google, Apple, Microsoft and Mozilla. The decision shortens the lifetime of public SSL certificates step by step.

Major certificate authorities (Sectigo, DigiCert, GlobalSign) switched to the new rules slightly ahead of schedule and issue certificates for 199 days, keeping one day in reserve.

Why this matters: the shorter a certificate lives, the less time an attacker has if a key is stolen or a certificate is issued by mistake. Domain ownership data is also checked more often and stays up to date.

Subscription and certificate are now two different things

You pay for a subscription, and the certificate is a file issued under that subscription. Their terms used to match, now they do not.

• Subscription is the paid period, for example 1 year. The price and billing term have not changed.
• Certificate is the actual file you install on your server. It is valid for no more than 199 days.

Example. You ordered Comodo PositiveSSL for 1 year on April 1, 2026:

1. The first certificate is issued right away and is valid until about mid-October 2026.
2. Before it expires, you reissue the certificate free of charge. The new one is valid until the end of the paid year.
3. After a year, you renew the subscription and the cycle repeats.

So if your browser shows that the certificate expires in six months, it is not an error and does not mean your subscription is shorter. This is the new normal.

If the subscription is paid for several years, there will be more reissues: about two per year, and about four per year from March 2027.

How to reissue a certificate

A reissue works almost the same way as the first issuance, which is described step by step with screenshots in Creation and installation of a paid SSL certificate. For a DV certificate it takes 10-15 minutes. Start 2-4 weeks before the current certificate expires, so you have time in case domain validation runs into trouble.

1. Generate a new CSR and private key, for example with the GoGetSSL CSR generator, just like for the first order. Save the key, you will need it for installation.
2. In your client area, open the SSL certificate service and start a reissue (Reissue). Paste the full CSR, including the "-----BEGIN CERTIFICATE REQUEST-----" and "-----END CERTIFICATE REQUEST-----" lines.
3. Choose DNS validation. The certificate authority will give you a CNAME record. Even if the record from the previous issuance is still in the zone, compare the values: they may be new for the reissue.
4. Add the CNAME record:
   • if the website is on a virtual or dedicated server, in the "DNS MANAGER" section of the client area;
   • if the website is on web hosting, in Plesk under "Hosting & DNS" → "DNS".
5. Go back to the service page and click "Revalidate". Once validation passes, refresh the page and download the certificate (CRT) and the chain (Intermediate/Chain).
6. Install the new certificate. In Plesk: "SSL/TLS Certificates" → "Manage" → "Add SSL/TLS Certificate", paste the key, certificate and chain, then assign the certificate to the website in "Hosting & DNS" → "Hosting".
7. Check the website with SSL Checker: the expiry date should be new and the chain complete.

The old certificate keeps working until its expiry date, so the website does not go down during the reissue.

Free Let's Encrypt certificates

The new rules do not affect Let's Encrypt certificates for now: they are already valid for 90 days and renew automatically. Let's Encrypt also plans to shorten validity, but for users nothing changes as long as auto-renewal works.

• In ISPmanager, Plesk and HestiaCP, Let's Encrypt is enabled in a couple of clicks, and the panel renews the certificate itself.
• On a server without a panel, use certbot or acme.sh. They schedule renewal and reload the web server.
• Every few months, check that renewal actually works. A common cause of failure is a domain moved to another IP or a closed port 80.

For most websites, a free certificate is enough. A paid one makes sense if the certificate authority's brand matters, if you need a warranty from the certificate authority, or if you need EV validation of your company.

Frequently asked questions

Can I still buy a certificate for one year or several years?
Yes. The subscription term has not changed, the certificate is simply reissued within it.

Do I have to pay for a reissue?
No, reissuing within the paid period is free of charge.

My certificate was issued in January 2026 for one year. Will it stop working?
No. Certificates issued before March 15, 2026 stay valid until their expiry date.

What happens if I forget to reissue?
Once the certificate expires, browsers will show visitors an insecure connection warning. Your subscription stays active, you can reissue right away, and the website will work normally again.

Have prices changed?
No, SSL certificate prices at FairyHosting remain the same.

Can support handle the reissue and installation for me?
Yes, contact us and we will help with the CSR, domain validation and installation.