Urgent Actions to Prepare for 90-Day SSL/TLS Certificates 

The CA/Browser Forum has approved a phased schedule that cuts the maximum validity of publicly trusted TLS/SSL certificates from 398 days down to 47 days by March 2029, replacing the earlier 90-day proposal that many teams are still planning around.  

CA/Browser Forum Ballot SC-081v3 sets a three-stage reduction in TLS certificate validity: 200 days from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. The earlier 90-day proposal was superseded. Organizations should build a full certificate inventory, adopt ACME-based automation, and centralize certificate lifecycle management now, since manual renewal cannot keep pace with a 47-day cycle. 

Key Takeaways 

• Ballot SC-081v3 replaces 90-day framing. The CA/Browser Forum’s April 2025 ballot sets validity at 200 days (March 15, 2026), 100 days (March 15, 2027), and 47 days (March 15, 2029). 
• Domain validation reuse shrinks in parallel. The maximum period a CA can reuse prior domain validation drops to 10 days by March 2029, forcing near-continuous revalidation. 
• Manual renewal does not scale below 90 days. A 47-day cycle means renewing every certificate roughly 7.5 times a year; ACME-based automation and centralized certificate lifecycle management (CLM) become mandatory, not optional. 
• Key compromise rules are unchanged and separate. Baseline Requirements still mandate revocation of a compromised certificate within 24 hours, regardless of the validity-period schedule. 
• Discovery is the first step, not renewal. Teams cannot automate what they cannot see; a complete certificate inventory across servers, load balancers, containers, and cloud services must come before automation.

The 47-Day Certificate Timeline 

CA/Browser Forum Ballot SC-081v3, which closed voting on April 11, 2025, replaces Google’s earlier 90-day proposal with a three-stage reduction to 47 days by 2029. 

Effective Date	Max Certificate Validity	Max DCV Reuse Period
Before March 15, 2026	398 days	398 days
March 15, 2026	200 days	200 days
March 15, 2027	100 days	100 days
March 15, 2027	47 days	10 days

The schedule affects two related limits: the maximum lifetime of the certificate itself, and the maximum period a Certificate Authority may reuse previously collected domain validation (DCV) and organization identity (SII) information instead of re-verifying it. 

This is the fourth major reduction in certificate lifespan since the CA/Browser Forum first capped validity at 60 months in 2012. Ballot 185 (2017) cut it to 825 days, and Ballot SC-22 (2019) cut it further to the current 398-day cap that most CAs enforce today. Google’s 2023 proposal for 90-day certificates did not pass; Apple’s competing proposal for a staged reduction to 47 days did, and the CA/Browser Forum adopted it as SC-081v3. 

Why Shorter Certificates Matter 

Shorter validity periods shrink the exposure window if a private key is compromised, because certificate revocation does not work reliably at internet scale. 

Revocation checking relies on Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP), and both have practical limits. Many browsers fail open when an OCSP check times out, meaning they continue trusting a certificate rather than blocking the connection. A shorter maximum lifetime limits how long a compromised certificate can be actively misused even if revocation never happens. 

A 398-day certificate gives an attacker up to thirteen months to exploit a compromised key. A 47-day certificate limits that same exposure to well under two months, independent of whether anyone notices the breach. 

Certificate Outages Are a Real Operational Risk 

Expired certificates already cause well-documented outages, and a 47-day cycle multiplies the number of renewal events that can go wrong. 

In December 2018, an expired software certificate in Ericsson’s core network equipment triggered a nationwide outage affecting O2, Tesco Mobile, and Sky Mobile in the UK along with SoftBank in Japan; O2 alone reported roughly 32 million affected subscribers over close to 24 hours. In 2020, an expired certificate briefly took down Microsoft Teams for users worldwide. Neither incident involved a sophisticated attack; both were routine certificates nobody tracked until they expired. 

At the current 398-day cadence, a missed renewal is rare enough that manual tracking can limp along. At a 47-day cadence, the same manual process fails on a predictable schedule. 

Immediate Actions for Certificate Teams 

Six actions separate organizations that will handle 47-day certificates smoothly from those that will spend 2027 firefighting outages. 

• Build a complete certificate inventory. Discover every certificate across servers, load balancers, containers, IoT devices, and cloud services. You cannot automate renewal for a certificate you do not know exists. 
• Adopt ACME or equivalent automated enrollment. Manual issuance and installation cannot sustain a 47-day renewal cycle across more than a handful of certificates. 
• Centralize policy and approval workflows. One issuance path, enforced consistently, reduces the misconfigurations that cause outages when renewal frequency goes up. 
• Integrate certificate issuance into CI/CD pipelines. Builds should fail safely on an invalid or soon-to-expire certificate rather than shipping it to production. 
• Monitor expiry continuously, tuned to 47 days. Alerting thresholds built for a 398-day cycle (for example, a 30-day warning) leave far too little room for a 47-day one. 
• Plan for machine identity growth. Non-human identities, including service accounts, containers, and API endpoints, already outnumber human identities in most enterprise environments and add to the renewal volume. 

Issues Presented by Reduced Timeframe of Validity of Certificates 

The transition to shorter certificate lifespans represents a significant shift in the management of digital certificates and enhances security by reducing the risk of compromised keys being misused over extended periods. However, this also brings several operational challenges that organizations must tackle efficiently.  

1. Frequent Certificate Renewals

   There is a need for more frequent renewals, which can go up to at least four times a year. It automatically increases the administrative burden, especially for enterprises managing thousands or even millions of certificates. This increased frequency not only strains resources but also increases the likelihood of human errors, leading to expired certificates.

   Every year, a huge number of organizations experience outages due to expired certificates. A study by DigiCert found that certificate outages cost large corporations an average of $5,600 per minute. A notable example is the 2020 Microsoft Teams outage, where an expired certificate left millions of users without access. It showed the business and reputational risks tied to inadequate certificate management.

2. Non-Automated Systems

   Relying on manual renewal processes was manageable with longer certificate lifespans, but with shorter certificate validity periods, it would become impractical. These manual methods often result in expired certificates or misconfigurations, causing disruptions or security risks. Legacy systems, which are older and not built for modern demands, face additional difficulties. They typically cannot support automated tools like ACME (Automated Certificate Management Environment), which are crucial for managing certificates efficiently.

   Furthermore, not all Certificate Authorities (CAs) and organizations are fully equipped to handle the accelerated issuance and renewal cycles that can create inconsistencies. Businesses are adopting centralized Certificate Management Systems to mitigate these challenges. Our solution, CertSecure Manager, provides a unified interface for tracking and renewing certificates.

3. Burden on the IT Team

   The shift to shorter certificate lifespans places a significant burden on IT teams. With certificates needing to be renewed more frequently, IT teams must handle a higher volume of renewals. It increases the likelihood of errors like expired certificates. This can lead to system outages, affecting services and productivity. Without automation, IT teams can spend a lot of time managing their certificates, taking time away from other important work. Automation can save time and keep teams focused on critical tasks.

   A major European mobile company named O2 faced an outage that lasted nearly a whole day due to an expired certificate from Ericsson. Millions of customers were affected by this certificate outage. As a result, O2 was compensated around $132.8 million by Ericsson.

4. Training and Upskilling Needs

   Workforce upskilling is another critical component, as IT and DevOps teams need training to manage modern certificate lifecycles efficiently. These strategies require investment, but they are essential for minimizing service interruptions, reducing resource strain, and ensuring compliance in an era of shorter certificate lifespans. Organizations that successfully take care of these measures not only mitigate the risks associated with frequent renewals but also position themselves for improved operational resilience and enhanced trust in their digital services.

Organizations need to use automation tools and certificate management platforms to ensure proper certificate lifecycle management. These tools make the renewal process easier by automating tasks like issuing, deploying, and tracking certificates. These tools are designed to integrate smoothly with diverse environments, including legacy systems.  

Immediate Actions for Efficient Certificate Management 

Several actions are mentioned below that will help you manage certificates effectively. 

1. Extensive Audit of Certificates

   It is essential to comprehend the existing certificate scenario for the successful completion of this task. Therefore, write down all the known attributes of each and every certificate in an easy-to-understand manner and make the inventory. It can include the owner’s name, location of installation, and expiration details. This inventory provides necessary insights to assess the risks posed by any expiring or expired certificates. Hence, it will be helpful to avoid any disruptions in the services provided as well as possible security threats.

   A worldwide organization like Google uses advanced certificate lifecycle management tools to conduct scans on their various websites, retrieve a report on all certificates in use, and underline the ones due for renewal. This way, the IT team gets a chance to mobilize and affect service renewal beforehand.

   CertSecure Manager automates the discovery and auditing of TLS/SSL certificates across the organization. It provides real time insights into certificate attributes, expiration details, and their locations. This ensures proactive risk assessment and minimizes service interruptions.

2. Set up Discovery and Monitoring stages

   The ongoing discovery of TLS/SSL certificates is of utmost importance for the proper management of inventory. Organizations require a platform that integrates the finding of new certificates while keeping their status in check to ensure that no certificate is left out and even those nearing expiry are dealt with accordingly.

   A global corporation such as Microsoft adopts the use of such tools to enable the constant monitoring of its entire global footprint. In this regard, such automated systems improve visibility and reduce the risk of gaps in certificate coverage by discovering all the active certificates.

   CertSecure Manager provides continuous discovery and monitoring of certificates across global infrastructures. You have a centralized dashboard to oversee all your SSL/TLS certificates. It allows you to track their status, validity dates, and the ownership details associated with each one.

3. Incorporate Risk Assessment Approaches

   It is very important to evaluate the potential risks of your certificate management practice on a regular basis. This will help you detect any weaknesses that can be exploited or edge cases that may cause downtime in services.

   For certificate management systems, new technology-oriented organizations may decide to do risk assessments concerning the project every six months. Focusing on those high-risk areas and devoting finances to them helps avoid such disruptions and retain the customers’ faith.

   CertSecure Manager includes risk assessment that evaluates vulnerabilities in certificate management practices. It generates detailed certificate health reports that highlight critical areas. It enables organizations to allocate resources effectively and maintain service reliability.

4. Create Policies and Workflows that are Centralized

   Encourage control policies for certificate management in your organization. There must be viable processes in place for any requests and approvals of new certificates to protect against teams breaking the new 90-day limit. Centralized policies ensure that all certificates within the organization follow the same process for issuance, renewal, and revocation. It also leads to consistency and reduces the risk of human error.

   Organizational workflows are impacted by the implementation of custom policies in Certificate Lifecycle Management by automating and streamlining key processes, reducing manual effort, and enhancing security. Companies with centralized CLM policies experience faster certificate deployment time, improving service uptime and compliance.

   CertSecure Manager offers centralized policy management and allows organizations to define and enforce certificate usage policies. It streamlines approval workflows for new certificate requests, ensuring compliance with organizational standards.

5. Automate Renewal Procedures

   Manually renewing thousands of certificates is a tedious task, but automation can simplify the renewal process and improve security posture. Organizations using automated certificate management solutions experience reductions in the time spent on certificate-related tasks. This translates to significant cost savings and allows IT teams to focus on more strategic initiatives.

   A 2022 study by VentureBeat showed that 81% of companies had experienced a certificate-related outage. This occurred within two years. It shows the significant risks associated with inadequate certificate management. These outages can result in substantial financial losses, and it is estimated by the Ponemon Institute that the average cost of IT downtime can be nearly $9,000 per minute.

   A huge banking institution has implemented CertSecure Manager, which automated the renewal of certificates intended for their online banking portal. Automating the renewal of digital certificates worked efficiently and has reduced the chances of downtime a lot. The access for the customers is always maintained without manual actions from the institution.

6. Incorporate Certificate Management into DevOps Processes

   Certificate management integration into the Continuous Integration/Continuous Deployment (CI/CD) framework increases efficiency and security. This integration makes it possible to ensure that the latest certificates are always used to deploy new applications or updates, hence minimizing the risks associated with using expired certificates in production.

   Incorporating certificate management into DevOps processes enhances security compliance with standards like PCI DSS (for secure payment processing), HIPAA (ensuring patient data protection in healthcare), GDPR (maintaining privacy and data protection in the EU), SOX (ensuring financial data integrity), and ISO 27001 (promoting information security management). Improvement in deployment speed can be seen by automating certificate management within DevOps pipelines. This is because manual interventions are minimized, which allows for more reliable and faster software releases.

   CertSecure Manager integrates seamlessly with CI/CD pipelines, such as Jenkins, GitHub Actions, and Azure DevOps, and automates certificate issuance and deployment during the build process. This ensures that only valid and secure certificates are used in production.

7. Maintain a Watch over Security Compliance

   Due to the rapid rotation of certificates, it is important to have a tool that monitors security and compliance on a regular basis. Certificates should be managed by their management system in accordance with the best practices.

   Big health insurance companies use certificate management software to find all the certificates in the organization on a quarterly basis and check which ones are HIPAA compliant. This is important to protect the patients’ private information and to keep the clients’ faith.

   CertSecure Manager helps organizations stay compliant with industry standards and regulations. Features like compliance monitoring and reporting are also functional for the users. It highlights certificates that fail to meet specific requirements, such as HIPAA or PCI-DSS, and provides actionable insights for remediation.

8. Support Rising Machine Identities

   With the progress of digital space, it is estimated by Cyberark that the number of machine identities will grow more than 2.4 times in the upcoming 12 months. As the demand for certificate management grows, the certificate authority market is expected to expand significantly. Research shows that the global certificate authority market size is going to increase from $81.7 million in 2019 to $285.7 million by 2030. This growth presents a compound annual growth rate (CAGR) of 12.3% from 2020 to 2030.

   This means that organizations must ensure that the certificate management strategies they have in place are able to cope with the changing demands without worrying about security issues.

   CertSecure Manager is built to handle the scalability demands of increasing machine identities. Its automated certificate provisioning and lifecycle management ensures seamless operations even as the number of machine identities grows exponentially.

9. Educate and Train Staff

   It is very important to ensure that your team is aware of why SSL/TLS certificates are important and that they are properly maintained. Training sessions can also explain how to manage certificates with shorter lifespans and why it is dangerous to forget about the handling of such certificates.

   Tech organizations arrange to hold training sessions on effective certificate management for their developers. This approach supports security culture practices and encourages team members to take part in protecting applications as part of their work.

   CertSecure Manager provides intuitive interfaces and detailed guides, which reduces the learning curve for IT teams. Additionally, its centralized platform simplifies certificate management and makes it easier for staff to adopt best practices with minimal training.

These measures will help in the smooth transition of organizations to 90-day TLS/SSL certificates without any compromise to security and compliance. The potential dangers related to shorter validity periods for certificates will be mitigated with the help of automation and strong certificate lifecycle management, and operations efficiency will be improved. As the requirements for digital security change, these efforts will enable organizations to carry out operations even in a turbulent environment without any interruptions of security. 

How can Encryption Consulting help? 

CertSecure Manager is Encryption Consulting’s certificate lifecycle management platform, built for exactly this transition. It automates discovery, issuance, renewal, and revocation across the shortened validity schedule, integrates with ACME and major CI/CD pipelines including Jenkins, GitHub Actions, and Azure DevOps, and gives IT teams one dashboard for every certificate they run. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices. 

Frequently Asked Questions

Is the 90-day certificate proposal still happening? 

 No. Google proposed a 90-day maximum validity period at the CA/Browser Forum in 2023, but the Forum adopted a competing Apple-backed proposal instead. Ballot SC-081v3 sets validity at 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029, which supersedes the 90-day framing entirely. 

When do 47-day certificates take effect? 

The 47-day maximum validity period takes effect March 15, 2029. It is the last step in a three-stage schedule that starts with 200-day certificates on March 15, 2026, and 100-day certificates on March 15, 2027. 

Do private or internal certificates have to follow this schedule? 

No. The CA/Browser Forum Baseline Requirements only govern publicly trusted certificates, meaning certificates issued by a CA in the major browsers’ root trust programs. Private PKI used solely inside an internal network is not bound by this schedule, though many organizations choose to align internal policy with it anyway. 

What happens if my organization keeps renewing certificates manually? 

Manual renewal becomes operationally unsustainable well before the 47-day deadline. A team managing even a few hundred certificates would need to process renewals almost weekly, and a single missed renewal causes an outage rather than a delayed reminder. Automated certificate lifecycle management is the practical alternative. 

Does a shorter validity period change how certificate revocation works? 

No. The Baseline Requirements’ revocation timelines are unchanged by this schedule: a confirmed key compromise or mis-issuance still requires revocation within 24 hours, and issues like expired domain validation require revocation within 5 days. Shorter validity periods reduce reliance on revocation working perfectly, since the certificate expires on its own soon regardless. 

Get Ready for 47-Day Certificates 

The path from 398 days to 47 days runs through 2029, but the automation work needs to start now. Explore CertSecure Manager to see how discovery, issuance, and renewal come together in one platform, or talk to an Encryption Consulting advisor about your certificate inventory. 

Conclusion 

The shift to 90-day certificate validity is a big change in digital security. It helps businesses to improve how they handle certificates. Shorter certificate lifespans reduce the risk of misuse, making systems safer from cyber threats. However, they also mean businesses must renew certificates more often, which can be challenging. To manage this, companies should regularly check all their certificates to avoid expired ones. Automating the renewal process saves time and prevents manual errors. Certificate lifecycle management tools should also be integrated with CI/CD pipelines to streamline updates during development. Managing everything from a single platform makes it easier to stay organized. By following these steps, businesses can improve security, avoid downtime, and ensure their services remain reliable and trusted.