TLS / SSL Certificate Lifetimes Reduced to 47 Days.

SSL Certificate Validation till 47 Days.

• The CA/Browser Forum has finalized a proposal that will change the TLS certificate landscape forever. 

• Starting in 2026 and fully enforced by 2029, public TLS / SSL certificates will have a maximum lifetime of just 47 days. 

• This major change will significantly impact how Middleware and Infrastructure teams manage web server security, certificate renewal processes, and application availability.

TLS / SSL Certificate Validity Reduction Timeline

Effective Date	Max Certificate Validity	Domain Validation Reuse
Until Mar 15, 2026	398 days	398 days
Mar 15, 2026	200 days	200 days
Mar 15, 2027	100 days	100 days
Mar 15, 2029	47 days	10 days

🕒 Effective Date

The date on which the new TLS certificate rules take effect. 

Starting from that date, the updated validity and validation rules must be followed.

📅 Max Certificate Validity

This is the maximum number of days a TLS certificate will remain valid. 

After this period, the certificate must be renewed or replaced.

🌐 Domain Validation Reuse

This is the number of days you can reuse domain validation (proving you own the domain). 

After this, you’ll need to re-validate the domain again for new certificates.

Impact on Middleware and Infrastructure Teams (OnPrem / Cloud)

• Shorter certificate lifetimes mean Middleware and Infrastructure engineers must shift from traditional, manual certificate management to more automated, robust, and monitored systems. 
• The focus must be on securing critical web frontends, load balancers, and backend integrations that rely on TLS encryption.

Web Server and Certificate Management Summary:-

Web Server	Certificate Format	Automation Support	Middleware Challenge
Apache HTTP Server	.crt, .key (PEM)	Yes (Certbot)	Reload needed post-renewal
NGINX	.crt, .key (PEM)	Yes (Certbot + plugins)	Restart/reload required on renewal
IBM HTTP Server (IHS)	.kdb, .sth (CMS format)	Manual or scripted	No ACME support, import via gskcapicmd required

SSL Certificate Automation means,  ACME (Automatic Certificate Management Environment).

 

It is a protocol developed by the Internet Security Research Group (ISRG) — the same organization behind Let’s Encrypt.

ACME is designed to automate the entire lifecycle of TLS/SSL certificates, including:

• Issuing new certificates.

• Renewing certificates before they expire.

• Validating domain ownership.

• Downloading and installing certificates.

Conclusion:-

• By 2029, TLS certificates will expire in just 47 days.
• Automate certificate issuance and renewal using ACME ( Using Certbot)
• Use monitoring tools to avoid expiry. (Using Openssl command from bash / .bat script to trigger alert)

Reference Link :

• https://www.thesslstore.com

• https://www.digicert.com

• https://www.cyberark.com/what-is/acme-protocol/