TLS certificate lifetimes are shrinking dramatically. The important date is no longer Google’s earlier 90-day proposal: the CA/Browser Forum has approved a phased reduction that takes publicly trusted certificates to a maximum of 47 days by March 15, 2029. Validation-data reuse will also fall, ultimately reaching 10 days.
Why this matters now
Shorter lifetimes reduce the window in which a compromised or misissued certificate remains useful, but they also make manual renewal processes operationally untenable. Organizations should treat this as a certificate-lifecycle automation program, not a calendar reminder for the PKI team.
Executive takeaway
By 2029, a 47-day maximum certificate will require renewal well before expiration. Any organization still discovering certificates through spreadsheets, ticket queues, or annual scans will face avoidable outages. The durable answer is automated discovery, issuance, deployment, validation, monitoring, and revocation across every environment.
What changed
- Maximum validity falls to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029.
- Domain-control validation reuse also tightens, eventually reaching 10 days.
- The burden shifts from periodic renewal work to continuous lifecycle engineering.
Architecture priorities
Build a complete inventory. Find internet-facing, internal, cloud-managed, appliance, container, service-mesh, and third-party certificates. Assign an owner and business service to each certificate rather than tracking only hostnames.
Standardize automated issuance. Prefer supported protocols and platform-native automation. Eliminate private-key handling in email, shared drives, and manual runbooks. Design for renewal to occur frequently and safely.
Validate deployment, not just issuance. A certificate can be issued successfully and still fail to reach a load balancer, CDN, ingress controller, legacy appliance, or secondary region. Post-deployment checks must confirm the served chain, hostname coverage, expiration, and application health.
Engineer for failure. Monitor renewal jobs, certificate transparency signals, expiration thresholds, and configuration drift. Define a tested emergency path for replacement and revocation without bypassing normal access controls.
Prioritized actions
- Measure inventory completeness and identify certificates with no accountable owner.
- Find every workflow that requires a human to request, approve, download, upload, or restart a service.
- Pilot end-to-end automation on a representative application, including rollback and post-deployment validation.
- Set an internal target well below 47 days so the operating model is proven before the final deadline.
- Add certificate lifecycle health to service reliability reporting and incident exercises.
Questions leaders should ask
- Can we identify every publicly trusted certificate and its business owner today?
- What percentage renews and deploys without human intervention?
- How do we know the new certificate is actually being served in every region?
- Which legacy platforms cannot support modern automation, and what is the retirement plan?
Shawn’s perspective
The security benefit of shorter certificates is real, but the larger lesson is operational. Certificate management is part of production reliability. Teams that approach it as an automation and ownership problem will improve both security and availability; teams that treat it as a PKI deadline will repeatedly rediscover the same fragile dependencies.