News & Articles

The 47-Day SSL/TLS Certificate Validity Starts in 2026. Here’s What to Do

It’s official! The SSL/TLS certificate validity begins this year. Here’s what you need to know.

SSL/TLS certificate validity periods are already being cut in half on March 15, 2026. Maximum lifespans and Domain Control Validation reuse periods both drop from 398 days to 200 days. This is the first in a series of reductions mandated by the CA/Browser Forum that ends at 47 days by 2029.

For organizations and businesses running manual certificate management, this deadline matters the most. The final 47-day standard is still three years out, but the processes needed to meet it have to be built and tested before 2026 forces the issue.

TABLE OF CONTENTS

What the CA/Browser Forum Approved

In April 2025, the CA/Browser Forum approved Apple’s original proposal, Ballot SC-081v3. The vote closed on April 11, 2025, with 25 certificate authorities and all four major browser vendors (Apple, Google, Mozilla, and Microsoft) voting in favor and with no votes cast against it.

The ballot requires a phased reduction in the maximum SSL/TLS certificate validity, along with a parallel reduction in the duration that domain control validation (DCV) data can be reused.

Here’s the timeline:

• March 15, 2026: Maximum validity drops to 200 days; DCV reuse drops to 200 days.
• March 15, 2027: Maximum validity drops to 100 days; DCV reuse drops to 100 days.
• March 15, 2029: Maximum validity drops to 47 days; DCV reuse drops to 10 days.

The two-year gap between 2027 and 2029 is intentional. The CA/B Forum designed this phased approach to provide organizations with a manageable path to compliance.

Additionally, the 47-day limit is not arbitrary. Each reduction is approximately half the previous period, with a small buffer added:

• 200 days = six full months (184 days) + half a 30-day month (15 days) + 1 day buffer
• 100 days = three full months (92 days) + roughly one week (7 days) + 1 day buffer
• 47 days = one full month (31 days) + half a 30-day month (15 days) + 1 day buffer

This structure aligns renewals with standard calendar intervals, simplifying automated scheduling.

Why Is the Industry Cutting Certificate Lifespans?

The move to shorter certificate lifespans addresses specific, documented weaknesses in the current system’s handling of trust and risk.

• Compromised private keys carry less value. A stolen key on a 398-day certificate gives attackers over a year of usable access. At 47 days, that exposure window shrinks to less than seven weeks.
• Revocation becomes less critical. Browsers inconsistently check Certificate Revocation Lists (CRLs) and OCSP responses. Certificates that expire quickly become invalid on their own, without depending on a revocation system that has historically underperformed.
• Cryptographic hygiene improves by default. Long-lived certificates can sit on outdated algorithms for extended periods. Shorter cycles force faster adoption of current standards across the board.
• Quantum readiness gets a foundation. Quantum computing will eventually threaten today’s cryptographic algorithms. Building the operational habit of frequent rotation now prepares organizations for a future migration to post-quantum cryptography (PQC).

What Does This Mean for Your Business

Shorter certificate lifespans translate directly into more work, faster deadlines, and less room for manual error.

Renewal volume will increase significantly. 

A team managing 1,000 certificates today handles roughly 4,000 renewal events per year under the current model. Under 47-day certificates, that same portfolio generates approximately 48,000 renewal events annually. Manual workflows cannot absorb that load.

Domain validation reuse shortens to 10 days. 

This is arguably the more demanding change. By 2029, organizations must revalidate domain ownership far more frequently than they do today. The 10-day DCV reuse window makes human-driven validation impractical.

OV and EV certificates have a separate track. 

Subject Identity Information (SII), which covers company name and organization details in OV and EV certificates, follows a different schedule. Starting March 15, 2026, SII can only be reused for 398 days. DV certificates carry no organizational identity data, so this change does not apply to them.

Internal PKI is not covered. 

The CA/B Forum rules apply only to publicly trusted certificates. Internal certificate authorities managing non-public systems can set their own validity periods. Even so, aligning internal practices with the new standards is worth considering.

Plan for Automation Before the Deadline Does It for You

Manual certificate management is approaching its operational limit. With 47-day validity periods and 10-day DCV reuse windows, the margin for human error disappears entirely. Most teams will find it impractical to reinstall certificates across their infrastructure every month manually.

The good news is that automation tooling has matured considerably. Organizations have several options depending on their environment and scale:

• AutoInstall SSL tools. Designed for Linux (Apache, NGINX) and Windows (IIS) servers, these tools automate certificate installation, reissuance, and renewal. Web hosts can also use host-specific versions to offer one-click automation to their customers across cPanel, DirectAdmin, and Plesk environments.
• ACME-based certificate services. Tools like Sectigo ACME Certificate-as-a-Service (CaaS) and DigiCert CertCentral ACME use the Automatic Certificate Management Environment protocol to handle issuance and renewal automatically. After a one-time setup, certificates renew without manual intervention. Both support major environments, including cPanel, Kubernetes, Linux, Plesk, and Windows IIS.
• Certificate Lifecycle Management (CLM) platforms. For organizations managing certificates across multiple CAs and environments, CLM platforms like DigiCert Trust Lifecycle Manager and Sectigo Certificate Manager provide centralized visibility, policy enforcement, and automated renewal. These integrate with Apache, NGINX, Microsoft IIS, AWS, GCP, Kubernetes, and more.

The March 2026 deadline is the practical cutoff for implementing automation. Piloting these tools now leaves time to resolve integration issues before the first reduction takes effect.

Action Plan

1. Audit your certificate inventory. Know exactly what you have, where it is deployed, and when each certificate expires.
2. Identify which renewals are automated and which are still manual.
3. Evaluate ACME support across your infrastructure and shortlist CLM platforms that fit your environment.
4. Run a pilot of automated renewal workflows before March 2026 to surface integration issues early.
5. Review your internal PKI policy to determine whether it should align with the new public standards.

The 2026 deadline is the first forcing function. Organizations that wait for 2029 will face a harder transition with less runway to fix problems.

Final Thoughts

SSL/TLS certificate validity has been shrinking for years. The 47-day mandate makes that direction a permanent policy. The phased schedule gives organizations time to adapt, but 2026 is close enough that preparation needs to start now.

From web hosting and domain services to web design and development in the Philippines, Syntactics, Inc. supports businesses across every layer of their digital presence. SSL and TLS Certificate compliance is part of that. If you need help reviewing your current setup or planning for upcoming changes, our team can help.

Get Design and Functionality
Specific to your Brand!

• Build a website that's mobile-friendly and responsive.
• Custom designs aligned with your brand.
• Optimized for SEO and user experience.
• Scalable and feature-rich solutions.

Book A Discovery Call!

Frequently Asked Questions About SSL/TLS Certificate Validity

When do the new SSL/TLS certificate validity rules take effect?

The changes roll out in three phases. Maximum certificate lifespans drop to 200 days on March 15, 2026, then to 100 days on March 15, 2027, and finally to 47 days on March 15, 2029. The Domain Control Validation reuse period follows the same schedule, ending at 10 days by 2029.

Does the 47-day rule apply to all types of SSL/TLS certificates?

It applies to all publicly trusted SSL/TLS certificates, regardless of validation level. That includes Domain Validated (DV), Organization Validated (OV), and Extended Validation (EV) certificates. The CA/Browser Forum rules do not cover internal certificates issued by private certificate authorities.

How does the 47-day validity period affect my website?

Your certificates will need to be renewed roughly every 47 days instead of annually. For websites relying on manual renewal, this means significantly more frequent intervention. Sites using automated renewal tools will handle the change with minimal disruption, provided the automation is configured correctly before the deadlines arrive.

Will shorter certificate lifespans increase my costs?

Not necessarily. Certificate pricing is typically structured around coverage periods rather than individual issuances. Organizations can still purchase multi-year plans and reissue certificates in alignment with the shorter validity windows. The primary cost increase comes from the operational overhead of more frequent renewals, which is why automation is central to managing this change efficiently.