Topic starter
24/06/2026 7:27 pm
TL;DR: Apple’s proposed CA/Browser Forum changes would shorten TLS certificate lifetimes to 47 days by 2029 and compress validation reuse windows far faster, making manual certificate operations unsustainable according to DigiCert. The practical shift is from certificate tracking to full lifecycle automation, because outage risk rises when request, validation, and installation still depend on people.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “47 Days: The New Certificate Lifetime Proposed by Apple”.
By the numbers:
- The current maximum lifetime of a TLS certificate is 398 days.
- As of March 15, 2029, the lifetime SHOULD not exceed 46 days and MUST not exceed 47 days.
- Currently, validation reuse for subject identity information is allowed for up to 825 days.
Key questions
Q: How should security teams prepare for shorter TLS certificate lifetimes?
A: Security teams should start by inventorying every certificate, identifying owners, and automating renewal for all high-risk and high-volume systems.
Q: Why do short-lived TLS certificates increase operational risk?
A: Short-lived TLS certificates increase operational risk because every renewal creates another chance for delay, misconfiguration, or missed deployment.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Practitioner guidance
- Automate the full certificate lifecycle Connect request, validation, issuance, installation, and renewal so no step depends on a person remembering the next deadline.
- Shorten validation dependencies Track how long domain and organisational validation evidence is reused and retire workflows that assume long-lived approval data.
- Inventory certificate deployments continuously Maintain real-time visibility into where certificates are installed, which systems depend on them, and which renewals are approaching.
Bottom line: Shorter TLS certificate lifetimes turn certificate management into a continuous operational control problem rather than a periodic renewal task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:43 am
47-day certificates turn certificate management into machine identity governance: This proposal collapses the comfortable distance between issuance and expiry that many teams still assume. A certificate is no longer a long-lived artefact with periodic renewal, it is a tightly bounded trust token that must be governed continuously. The practitioner conclusion is that certificate operations now sit in the same governance conversation as other non-human identities.
A question worth separating out:
Q: What is the difference between certificate visibility and certificate lifecycle automation?
A: Certificate visibility tells you what exists, where it is, and who depends on it. Certificate lifecycle automation goes further by orchestrating request, approval, issuance, installation, renewal, and audit with less manual intervention. Teams need visibility first because automation cannot reliably fix assets they cannot find, classify, or assign to an owner.
👉 Read our full editorial: 47-day TLS certificates force certificate lifecycle automation