In brief
Every padlock in your browser rests on a certificate, and certificates expire. For years, the longest a website certificate could last was 398 days, a little over a year. That is now shrinking, in steps, to 47 days. The first cut came in March 2026. If your team still renews certificates by hand from a calendar reminder, this is your warning.
What was decided?
The CA/Browser Forum, where certificate authorities and browser makers set the rules, passed ballot SC-081v3 in April 2025. It sets an eventual reduction of maximum validity from 398 days to 47 days, with the reductions starting in March 2026 and concluding in March 2029.
A related change matters as much: how long a certificate authority can reuse its check that you control a domain will fall from 398 days to 10 days.
This wasn't contested. All four browser makers, Apple, Google, Microsoft and Mozilla, voted yes. So did 25 certificate issuers, with none voting against. Interestingly, one of the yes votes came from eMudhra, the Indian authority later at the centre of the weak-keys incident we covered.
Why shorter?
The ballot's argument is simple. A certificate is a snapshot of a point in time: who owned the domain, which key it used. The longer it lives, the more likely that snapshot is out of date. A domain may have been sold. A key may have leaked.
There's a practical reason too. The rules already say authorities must sometimes revoke certificates within 24 hours. In practice, many organisations can't replace certificates that fast, and the ballot admits real-world practice has not necessarily reflected such an expectation. Short lifetimes force the automation that makes fast replacement possible.
Our reading: the eMudhra episode shows why. When trust in a certificate authority breaks, teams that can swap certificates in minutes barely notice. Teams that can't, scramble.
Who is affected?
Anyone running a public website, API or app backend with a publicly trusted certificate. Internal certificates from your own private authority aren't covered by these rules, though the same logic applies.
How to prepare
- Automate renewal. Use ACME, the standard protocol behind free certificate services and most commercial ones, everywhere you can.
- Find every certificate. Load balancers, CDNs, appliances and forgotten test sites all count. Scan your domains and check Certificate Transparency logs for what's been issued in your name.
- Monitor expiry, with alerts well before the date, sent to a team, not one person.
- Fix the awkward ones now. Devices that need a manual upload are the ones that will break at 47 days. Replace them or put a proxy in front.
- Rehearse a swap. Time how long it takes to replace a certificate in a hurry.