Are You Ready for 47-Day Certificate Lifetimes?

The CA/Browser Forum plans to reduce the maximum validity of publicly trusted TLS certificates from 398 days to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029, with domain validation reuse limited to 10 days at the final stage. The changes apply to public-facing certificates for services such as websites, APIs, mail servers, VPNs, CDNs, and browser-accessible appliances, while privately operated internal certificate authorities remain outside the policy. The text argues that increasingly frequent renewals will make manual certificate tracking costly and prone to outages, particularly when certificates lack clear ownership, are distributed across multiple platforms, fail to trigger service reloads, or rely on infrastructure without ACME support. It recommends creating a centralized certificate inventory through endpoint scanning, automating issuance and deployment where possible, monitoring the certificates actually served to clients, addressing legacy-device exceptions, testing renewal processes, and preparing a backup certificate authority. It also presents Infisical Certificate Management as a tool intended to centralize discovery, issuance, renewal, deployment integrations, and alerts across multiple certificate systems and protocols.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.