TLS certificates are heading to 47 days: automation is no longer optional
CA/Browser Forum ballot SC-081 caps certificate lifetimes at 200 days from March 2026, 100 days from 2027, and 47 days from 2029. Manual renewal has a deadline now.
In April 2025 the CA/Browser Forum passed SC-081, which puts a firm schedule on TLS certificate lifetimes. It is not a suggestion — every publicly trusted CA has to follow it. The one-year certificates you have today cannot be reissued once they expire.
The schedule
| Effective | Maximum validity | Data reuse period |
|---|---|---|
| 2026-03-15 | 200 days | 10 days |
| 2027-03-15 | 100 days | 7 days |
| 2029-03-15 | 47 days | 0 days |
The “data reuse period” is the window in which the same domain set and public key can be reused for a new certificate. At zero it means a fresh key pair every 47 days — no more re-signing an old CSR forever.
Why this is happening
Browser vendors are pushing it: the shorter a certificate lives, the smaller the window after a key leak, and the less the ecosystem depends on revocation, which has never worked reliably. The number has fallen from 39 months to 398 days, to one year, and now to 47 days. The direction has not changed in a decade.
Three things to change
- Renewal must be fully automated. An ACME client (certbot, lego, acme.sh) is not “installed and done” — confirm it runs on every node, actually renews, and reloads the service afterwards. If you do not have automation, start now;
- Monitor days remaining, not expiry. With a 47-day certificate the human window is a few days; alert at 15 and 7 days remaining;
- Put key rotation in the process. Once reuse hits zero, renewal means a new key plus a new certificate, so anything that pins a key fingerprint (pinning, allowlists) has to change in advance.
Do not forget internal systems. Many companies use ACME externally and still run one-year self-signed certs internally. The ballot does not cover those, but the browser push for short lifetimes will reach them eventually.
The judgement
Shorter certificate lifetimes are not a new task for the security team — they turn a certificate from a manual asset into an automated pipeline. March 2026’s 200 days is the first exam; the hard one is 47 days in 2029, when a site without automated renewal will fall over every 47 days.
Cover image: Let’s Encrypt certificate detail screenshot (Wikimedia Commons).
Comments
…