CA/Browser Forum ballot SC-081v3, adopted on 11 April 2025, sets the schedule by issuance date: 398 days before 15 March 2026; 200 days from 15 March 2026; 100 days from 15 March 2027; 47 days from 15 March 2029. Domain-validation data may be reused for 200 days, then 100, and only 10 days from 15 March 2029; organization identity data for 398 days. Validity counts both ends inclusively, and one extra second counts as a whole day.
History: lifetimes were capped at 60 months in 2012, then 39 months (2015), 825 days (2018) and 398 days (September 2020, first enforced by Apple). The drivers are faster key rotation, quicker removal of bad validations and making revocation less important.
Practical meaning: manual renewal once a year is no longer viable; ACME or a vendor API is. Let's Encrypt plans to shorten its default classic profile from 90 to 64 days on 10 February 2027 and to 45 days on 16 February 2028. The lifetime calculator shows the limit that applies to a given issuance date.