March 15, 2026 — 200 days
The maximum validity period moved from the previous 398-day limit to 200 days.
The certificate automation deadline
47-day public TLS certificates are coming. Automation needs to come first.
The CA/Browser Forum schedule reduces the maximum validity period for publicly trusted TLS certificates to 100 days on March 15, 2027 and 47 days on March 15, 2029.
At that frequency, certificate rotation is no longer occasional maintenance. Teams need repeatable issuance, renewal, deployment, validation, monitoring, and audit workflows that can run continuously.
200dMar 2026
100dMar 2027
47dMar 2029
Validity timeline
Public TLS certificate lifetimes are shrinking in stages.
The CA/Browser Forum Server Certificate Baseline Requirements establish the following maximum validity schedule for publicly trusted TLS Subscriber Certificates.
March 15, 2027 — 100 days
The maximum validity period drops again to 100 days.
March 15, 2029 — 47 days
The maximum validity period reaches 47 days, while domain and IP address validation data reuse drops to 10 days.
What changes operationally
Manual certificate rotation becomes a recurring failure mode.
A shorter validity period multiplies the number of renewal and deployment events your organization must execute correctly. The answer is not simply “renew faster”; the entire lifecycle needs automation and verification.
Automate renewal
Use ACME, APIs, or managed lifecycle workflows where supported instead of relying on calendars and manual certificate requests.
Automate deployment
Move renewed certificate material to the correct services and devices without creating a new manual handoff every few weeks.
Validate after rotation
Confirm the expected certificate is actually present on disk and being served by the live TLS endpoint.
Automation checklist
Build a lifecycle that can tolerate frequent certificate replacement.
1
Inventory certificates and owners
Know which services depend on each certificate, where it is deployed, and who owns the lifecycle.
2
Automate issuance and renewal
Move away from manual renewal processes before rotation frequency increases further.
3
Automate deployment
Connect lifecycle events to deployment targets, file paths, and service reload workflows.
4
Validate and alert
Verify the live service is using the expected replacement certificate and alert on expiration or validation failure.
Important scope
The 47-day requirement is for publicly trusted TLS certificates.
The CA/Browser Forum Baseline Requirements apply to publicly trusted TLS certificates, not certificates issued solely by your private PKI. SecuriTLS focuses on automating certificate lifecycle operations and private PKI; use this schedule as a concrete reason to eliminate manual certificate operations across your infrastructure.