Topic starter
06/11/2026 6:55 pm
TL;DR: SSL certificate lifetimes are moving toward 47 days, according to AppViewX's analysis of certificate management pressure. Renewal handling will need to shift from human memory to governed automation before outages and orphaned certificates become routine.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “47-Day SSL Certificate Lifetime: Navigating the New Maximum Validity Periods”.
By the numbers:
- The CA/Browser Forum will reduce maximum certificate lifetimes to 200 days by March 2026, then to 100 days by March 2027, and finally to 47 days by March 2029.
- All four major browser vendors, Apple, Google, Mozilla, and Microsoft, voted in favour of the 47-day certificate proposal.
Key questions
Q: Why do short-lived certificates reduce identity risk in large environments?
A: They shorten the period in which a forgotten, stale or misissued certificate can be used.
Q: What is the difference between certificate expiry and revocation?
A: Expiry ends trust automatically at a scheduled date, while revocation removes trust early because the certificate is no longer safe or appropriate to use.
Q: How do you inventory SSL certificates across cloud and on-premise estates?
A: Inventory SSL certificates by combining automated discovery of certificates on load balancers, web servers, proxies, containers and managed cloud services with scans of certificate stores, configuration repositories and DNS-linked endpoints.
Practitioner guidance
- Centralise certificate discovery Scan domains, subdomains, internal systems, cloud estates, and third-party services so every certificate has an owner and a renewal path.
- Automate certificate renewal Replace calendar reminders and manual tickets with issuance workflows that renew and install certificates before expiry without human intervention.
- Set escalation-based expiry monitoring Create alerts weeks before expiry, route them to the accountable team, and escalate if no action is taken.
Bottom line: Shorter certificate lifetimes shrink the window for abuse but also remove the margin that manual renewal workflows depended on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
47-day certificates convert certificate management from periodic hygiene into continuous identity governance. The shortening lifecycle does not merely increase operational work; it removes the room for informal ownership and delayed renewal. Programmes that treat certificates as static infrastructure will fail first, because the trust window is becoming shorter than their review cadence. The implication is that certificate governance now belongs in the same discipline as other lifecycle-controlled identities.
A question worth separating out:
Q: How should teams prevent a certificate renewal failure from taking down a public website?
A: Teams should treat certificate renewal as an operational dependency, not a background task. Use automated renewal, but verify that the renewal path actually works in every relevant network path and protocol. Add independent expiry checks, redundant calendar reminders, and a manual renewal window. If a proxy, CDN, or IPv6 route sits in front of the origin, test that path separately.
👉 Read our full editorial: 47-day certificate cycles will force PKI governance to mature