The 47-Day Certificate Deadline Nobody on Your Team Is Tracking

November 10, 2026

Rodney Hall, COO— AI-assisted and reviewed prior to publication.

Public TLS certificates will stop lasting a year within the next few months. The CA/Browser Forum's Ballot SC-081v3 cuts maximum certificate validity from 398 days to 200 days starting March 15, 2026, then to 100 days in 2027, and finally to 47 days by March 2029. Teams that still renew certificates by hand are about to find out how often "by hand" breaks.

What did the CA/Browser Forum actually vote to change?

On April 11, 2025, the CA/Browser Forum passed a ballot that replaces today's 398-day maximum certificate lifespan with a phased countdown toward 47 days. The schedule was initially proposed by Apple after Google had pushed a 90-day version years earlier, and it passed with no formal dissent even though several large certificate authorities had reservations about the pace.

The timeline is binding for every publicly trusted TLS certificate, not optional guidance teams can defer. Here is how the reduction actually lands:

That schedule comes directly from the ballot's phased reduction structure, and the 2026 step is close enough that any certificate issued today under the old rules will likely need to be reissued under the new ones before it would naturally expire.

Why does cutting certificate life to 47 days matter for your security team?

It matters because certificate renewal stops being an annual chore and becomes a near-constant background process. At 47 days, a certificate that used to renew once a year now renews roughly eight times, and every one of those renewals is a chance for an expired or misconfigured certificate to take down a service.

That risk is not hypothetical. CyberArk's 2025 State of Machine Identity Security Report found that 72% of organizations had already experienced at least one certificate-related outage in the past year, under the current 398-day system. The same research found that a third of organizations still manage machine identity lifecycles with manual or non-automated methods. Shrinking the renewal window eightfold without changing how certificates get issued is a plan to multiply that outage rate, not reduce it.

The industry's own guidance acknowledges this directly. DigiCert has said it expects the 2027 move to 100-day certificates to make manual processes untenable well before the final 47-day deadline arrives, which is why the company is pushing automation adoption now rather than waiting for 2029. Anyone who manages certificates through a spreadsheet and a calendar reminder is on borrowed time.

The math behind the pressure

Run the numbers on a mid-size environment with a few thousand public-facing certificates. At a 398-day lifespan, a team might process a renewal every day or two across the whole portfolio. At 47 days, the same portfolio needs renewals roughly eight times more often, which turns a task one person could track manually into something that only survives with automated issuance, validation, and deployment.

This is exactly the use case the ACME protocol was built for. The National Institute of Standards and Technology defines ACME as a standardized protocol for automated certificate enrollment, and it is quickly becoming the default mechanism for keeping up with CA/Browser Forum's new cadence. Teams that haven't built ACME or an equivalent automation pipeline into their certificate workflow will be reissuing certificates by hand on a schedule that gets tighter every year for the next three years.

Who owns certificate lifecycle automation on your team right now?

For most organizations, the honest answer is nobody specifically. Certificate management has historically been a shared, low-visibility responsibility split between network engineers, cloud administrators, and whoever happened to set up the original CA account, and that arrangement does not survive an eightfold increase in renewal frequency.

This is the same skills gap showing up across infrastructure security more broadly. Sectigo's analysis of the certificate lifecycle management gap points out that the ongoing IT skills shortage leaves many organizations without staff who understand both PKI architecture and the automation tooling needed to run it at scale. That gap is about to get more expensive, because the organizations that treat certificate automation as someone else's problem in 2026 will be the ones explaining an outage to customers in 2027.

Closing that gap takes more than buying an automation tool. It takes someone on the team who understands certificate chains, revocation, key management, and how to design an architecture where short-lived certificates renew themselves without human intervention. That is enterprise security architecture work, and it's the kind of material covered in depth in Forge University's CompTIA SecurityX certification prep, which goes beyond baseline PKI concepts into the automation and orchestration skills this deadline actually demands.

What you should do before March 2026

Start by inventorying every public certificate your organization controls and confirming which ones were issued under the current 398-day maximum, since those will need attention before the 200-day ceiling takes effect. From there, the priority list looks like this:

• Identify every system issuing or consuming public TLS certificates, including ones outside the primary CA account that teams forget about.
• Stand up or extend ACME-based automation so renewal, validation, and deployment happen without a person clicking through a portal.
• Assign explicit ownership of certificate lifecycle automation to a named role, not a shared responsibility that quietly belongs to nobody.

None of this is exotic engineering. It is disciplined PKI operations applied at a pace the industry hasn't required before, and the teams that get ahead of it now will spend 2027 unbothered while everyone else scrambles. If your team needs a structured way to build that expertise, the curriculum overview and certification FAQ on Forge University's resources page is a reasonable place to see how PKI, cryptography, and automation fit together across different certification tracks.

The 2026 deadline is close enough that waiting for budget approval or a formal project charter is not a real option anymore. If you want a study plan built around enterprise PKI and security architecture before the 100-day step lands in 2027, you can start training now rather than after the first renewal cycle goes wrong.

Certificate lifespans are not shrinking because the standards bodies enjoy churn. They are shrinking because long-lived certificates give attackers a long window to exploit a compromised key before anyone notices, and the industry has decided that window needs to close. The organizations that treat this as a scheduling problem will struggle. The ones that treat it as an architecture problem, with a named owner and automated tooling, will barely notice the deadline when it arrives.

Start training free at Forge University