By 2029, public Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates will be capped at 47 days, following the CA/Browser Forum’s (CA/B) Ballot SC-081v3. This phased reduction, supported by major browsers and Certificate Authorities (CAs), greatly enhances digital trust but demands automation. This article offers leaders a phased, vendor-neutral roadmap to turn compliance into operational advantage.

The Backbone of Digital Trust Is Accelerating

Every secure online interaction relies on SSL/TLS certificates: from payments and healthcare data to Software-as-a-Service (SaaS) logins and Application Programming Interfaces (APIs), and the maximum certificate lifespan has narrowed from multi-year terms (3-5 years) to roughly one year, now capped at 398 days.

By 2029, no public certificate will last more than 47 days. In practice, organizations will renew and replace SSL/TLS certificates about every six to seven weeks, including quick checks to confirm domain control before each update.

• Positive Impact: Stronger security hygiene, shorter exposure risk, readiness for quantum cryptography shifts.
• Critical Risk: Without automation and monitoring, organizations face outages, failed transactions, and a decline in customer trust.

The Step-Down Schedule

The new mandate arrives in stages, providing organizations clear checkpoints:

• 2027: 200 days maximum.
• 2028: 100 days maximum.
• 2029: 47 days maximum.

Manual certificate renewals will quickly become fragile as validity periods shorten and the need for renewals multiply and error margins shrink.

How Did We Arrive Here?

In April 2025, the CA/Browser Forum’s Ballot SC-081v3 passed with near-unanimous approval. All major browser vendors (Apple, Google, Mozilla, Microsoft, etc.) endorsed the shift. Leading certificate authorities like DigiCert, Sectigo, GlobalSign, GoDaddy, and Amazon also supported it. Out of 29 votes, none opposed.

This alignment is almost unprecedented. For leaders, the result is clear: this global standard is not optional, not reversible, and not merely an IT detail. It is the baseline for digital trust.

47: The New Trust Anchor?

The move to a 47-day certificate is intentional. Industry stakeholders considered several options and settled on this period as it is short enough to close security gaps but long enough to be workable for automation.

The shorter certificate lifespans dramatically reduce the time attackers can use stolen or compromised keys, thereby shrinking the threat window to weeks instead of months. With frequent renewal, outdated or risky certificates are removed quickly, keeping organizations safer. Importantly, this shift lessens dependence on unreliable revocation mechanisms like OCSP and CRL, which are slow to update and inconsistently used in browsers. Certificates now automatically expire, simplifying clean-up and enforcement.

Preparing Organizations

As rapid certificate renewal cycles make manual management impractical, automation becomes critical to success. To get started, consider the following phased roadmap:

Phase 1: Assess and Inventory (Now–2026)

• Map all certificates.
• Identify manual or legacy workflows.
• Assign executive ownership.

Outcome: Full visibility with no hidden gaps.

Phase 2: Automate and Standardize (2026–2027)

(Max Cert Validity: 200 days)

• Deploy automation protocols such as ACME, EST, SCEP, or CMP to streamline certificate issuance and renewal across systems.
• Integrate renewals into IT workflows.
• Standardize governance across cloud and hybrid environments.

Outcome: Most certificates are renewed automatically before the 200-day cap.

Phase 3: Monitor and Operationalize (2027–2028)

(Max Cert Validity: 100 days)

• Implement central dashboards for certificate visibility and schedule operational reviews (OP15N) with senior leadership to ensure risks are identified and addressed at the highest level.
• Define Digital Trust SLAs. Renew certificates before a set lifespan threshold and stagger renewals to prevent bottlenecks.
• Train teams to treat failed renewals as critical incidents.

Outcome: Renewal issues are detected early and resolved quickly.

Phase 4: Collaborate and Future Proof (2028–2029)

(Max Cert Validity: 47 days)

• Require partners and vendors to support rapid automated renewals.
• Test for cryptographic agility and quantum preparedness.
• Share best practices in industry forums.

Outcome: The organization operates with automated efficiency, ready for rapid change, and built for the future of digital trust.

Phase 5: Review and Refine (Ongoing)

• Regularly audit certificate management, adjusting policies, tools, and procedures in response to new risks, compliance requirements, and lessons learned.

Outcome: A continuously improving, resilient certificate management ecosystem.

What Leaders Must Do Now

Moving to 47-day certificates is not only a technical task and requires executive action:

• Audit all certificate inventories and renewal processes. Identify vulnerabilities in manual or legacy workflows.
• Transition to end-to-end automation. Adopt interoperable standards like ACME where possible, and ensure flexibility to shift across vendors, platforms, and tools.
• Implement advanced monitoring and response protocols. Alert on and triage failed renewals before they impact users or compliance.
• Educate and coordinate teams across the organization. Document processes, train staff, and embed certificate management into change management and incident playbooks.
• Engage with vendors and partners. Ensure external services are compatible with rapid renewal and robust automation.

From Compliance to Advantage

The transition to 47-day certificates is more than a compliance milestone; it represents the next stage in digital trust. To truly succeed, the IT industry must build automation not just for individual organizations but across entire ecosystems. Protocols like ACME, robust internal PKI, and cloud-agnostic lifecycle tools have become essential. Real progress will come when peers, partners, and consortiums collaborate on sharing playbooks, open standards, and operational intelligence, celebrating wins and hard learned lessons.