The CA/Browser Forum has established a roadmap to reduce the validity period of public SSL/TLS certificates. By 2029, the maximum duration for these certificates will be limited to 47 days. This initiative aims to enhance internet security by limiting the window of opportunity for attackers in the event of a certificate compromise.
The transition is occurring in stages. Starting in March 2026, newly issued certificates will have a maximum validity of 200 days. Existing certificates will remain valid until their expiration date. Additionally, by March 2029, the period for re-validating domain control will be reduced to 10 days, requiring more frequent checks by certification authorities.
The shift necessitates a move toward automated certificate management, as manual renewal will become impractical. Organizations are encouraged to utilize the ACME protocol for automated issuance and installation. Challenges for businesses include upgrading legacy infrastructure that does not support automation and implementing robust monitoring to prevent service outages due to renewal failures.
While the technical validity of individual certificates is shrinking, certification authorities may continue offering annual subscription models that include automatic re-issuance. Users of services like Let's Encrypt, which already utilizes a 90-day cycle, are largely prepared for this transition. However, companies managing large server fleets may face increased operational costs related to infrastructure modernization.
