Topic starter
10/07/2026 9:08 pm
TL;DR: The CA/Browser Forum has approved a phased reduction in public TLS certificate lifetimes from 398 days to 47 days by 2029, with interim cuts beginning in 2026, turning renewal cadence into a recurring operational burden rather than an annual task, according to eMudhra. Manual certificate operations will not scale; automation becomes the difference between routine control and outage-prone sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “47-Day TLS Certificates: CA/B Forum's New Rules 2026”.
By the numbers:
- Public TLS certificate lifetimes will fall from 398 days today to 47 days by 2029.
- Starting March 2026, certificate lifetimes drop from 398 days to 200 days.
- By March 2027, the maximum TLS certificate lifetime drops further to 100 days.
Key questions
Q: What breaks when certificate lifetimes shrink to 47 days?
A: Manual certificate processes break first, followed by renewal consistency, deployment timing, and outage tolerance.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: What do teams get wrong about certificate automation?
A: They often treat it as a convenience upgrade instead of a resilience control.
Practitioner guidance
- Automate end-to-end certificate lifecycle management Map discovery, CSR generation, validation, deployment, renewal, and expiry alerting into a single governed workflow so no renewal step depends on manual intervention.
- Inventory every public TLS certificate and its owner Build a complete certificate inventory across cloud, on-premise, and DevOps systems, then assign business ownership and renewal responsibility for each certificate-bearing service.
- Remove manual domain control validation steps Replace annual DNS edits and ad hoc validation handling with automated domain control validation that can keep pace with shorter reuse windows.
Bottom line: Shorter TLS lifetimes turn certificate handling into a continuous lifecycle problem rather than a yearly maintenance task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Certificate lifecycle automation is now an identity governance requirement, not a PKI convenience. The shrinking public TLS window turns certificates into high-frequency machine identities with ownership, renewal, and offboarding dependencies. That shifts the control problem from simple issuance to governed lifecycle management across discovery, validation, deployment, and expiry. Practitioners should treat this as a machine identity programme problem, not a certificate-team only problem.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: How should security teams prepare for shorter TLS certificate lifespans?
A: Security teams should inventory all certificates, assign clear owners, automate renewal workflows, and test replacement before the new validity window takes effect. The goal is to remove manual dependency from a process that will soon recur much more often. Organisations that wait for the first outage will already be behind.
👉 Read our full editorial: 47-day TLS certificates will force certificate lifecycle automation