Topic starter
24/06/2026 7:08 pm
TL;DR: The CA/Browser Forum has approved a schedule that cuts TLS certificate lifetimes from 398 days to 47 days by 2029, while reusing validation data for just 10 days, according to DigiCert. Manual certificate operations will not scale, and lifecycle automation becomes the deciding control for reliability and trust.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “TLS Certificate Lifetimes Will Officially Reduce to 47 Days”.
By the numbers:
- The maximum certificate lifetime will fall from 398 days to 47 days by March 15, 2029.
- The maximum period during which domain and IP address validation information may be reused will fall to 10 days by March 15, 2029.
- Subject Identity Information reuse will drop from 825 days to 398 days as of March 15, 2026.
Key questions
Q: How should teams prepare certificate operations for 47-day TLS lifecycles?
A: Teams should move from periodic renewal handling to always-on certificate lifecycle governance.
Q: Why do shorter TLS lifetimes increase outage risk?
A: Shorter lifetimes compress the time available to detect, approve, renew, and deploy certificates before expiry.
Q: What breaks when certificate validation data cannot be reused for long periods?
A: What breaks is the assumption that one-time validation can support long-lived trust.
Practitioner guidance
- Automate certificate renewal workflows Replace manual issuance and renewal steps with automated workflows that can renew, deploy, and validate certificates before expiry across all environments.
- Shorten validation ownership loops Map who owns domain, organisation, and IP validation records, then ensure those records can be refreshed as quickly as the new reuse windows require.
- Inventory all certificate dependencies Build a complete inventory of TLS certificates, including internal services, customer-facing systems, and hidden dependencies that could fail if a certificate expires.
Bottom line: Shorter TLS certificate lifetimes turn certificate management into a continuous lifecycle problem rather than an annual maintenance routine.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:18 am
Certificate lifecycle control is becoming a governance discipline, not a maintenance task: The schedule change means certificate issuance, validation, and renewal now behave like a continuous identity lifecycle rather than a yearly admin cycle. That matters because the real control is no longer the certificate itself, but the process that keeps it current across distributed infrastructure. Practitioners should treat certificate operations as part of identity governance, not an isolated PKI activity.
A question worth separating out:
Q: What is the difference between certificate visibility and certificate lifecycle automation?
A: Certificate visibility tells you what exists, where it is, and who depends on it. Certificate lifecycle automation goes further by orchestrating request, approval, issuance, installation, renewal, and audit with less manual intervention. Teams need visibility first because automation cannot reliably fix assets they cannot find, classify, or assign to an owner.
👉 Read our full editorial: TLS certificate lifetimes fall to 47 days: automation becomes mandatory