In April 2025 the CA/Browser Forum, the body where certificate authorities and browser makers agree the rules for public TLS certificates, approved Ballot SC-081. It shortens the maximum validity of a certificate in three steps.
The timeline
- From 15 March 2026: certificates can be valid for at most 200 days.
- From 15 March 2027: at most 100 days.
- From 15 March 2029: at most 47 days.
The period for which a certificate authority may reuse a domain validation shrinks alongside it, reaching 10 days in 2029. In practice that means proving control of your domain far more often.
Why the industry is doing this
A certificate is a promise that a key belongs to a domain. The longer that promise lasts, the longer a stolen key or a mistakenly issued certificate stays useful to an attacker. Revocation was meant to solve this, but it has never worked reliably at internet scale. Short lifetimes make the problem expire on its own.
What it means for your business
If anyone on your team renews certificates by hand, that process is now on a countdown. At 47 days, a certificate needs replacing roughly eight times a year, for every domain and subdomain you run. A single missed renewal takes a site, an API or a payment page offline with a browser warning.
The answer is automation:
- Use ACME, the protocol behind automatic issuance, wherever your servers support it.
- Inventory every certificate you have, including those on load balancers, mail servers and internal tools.
- Monitor expiry dates centrally and alert well before the deadline, not on the day.
- Check that DNS changes needed for validation can be made automatically.
How IDX handles it
Certificates on IDX hosting renew automatically, and our SSL service covers the cases automation alone does not, such as organisation-validated certificates for businesses that need them. If you run your own servers with us, our managed services team can set up ACME and expiry monitoring so the 2029 deadline passes without anyone noticing.
IDX on digital infrastructure
Back to blog →