Phased reductions from 398 to 200 days now, then 47 days by 2029, boost security but increase outage risks.
This month in 2026, digital trust faces a policy change that affects how organizations approach security. The CA/Browser Forum, a consortium of browser vendors and certificate authorities, has approved a much-debated phased reduction in certificate lifespans via Ballot SC081v3 (April 2025).
With the first milestone on 15 March, the maximum lifetime of a publicly trusted TLS certificate will drop from 398 days to 200 days, with further reductions planned to reach 47 days by March 2029.
Shorter certificate lifespans aim to improve security and agility in the encrypted ecosystem. More frequent certificate rotations can reduce the window for exploiting a compromised certificate or key, while also promoting automation in certificate lifecycle management to detect issues faster and replace credentials more quickly.
However, for already-stretched IT teams, this change means a significant increase in administrative volume.
Shorter certificate lifespans: operational challenges
Shorter certificate lifespans require higher renewal frequency. The shift to 200 days doubles the renewal cadence immediately, and it increases about eightfold by the 47-day target.
For a large enterprise managing 10,000 certificates today, this could mean around 90,000 annual renewals by 2029. More renewals raise the risk of outages and expirations. These risks often stem from fragmented, manual processes that are easy to overlook.
Visibility gaps contribute heavily to these issues. Many organizations still use partially manual processes, with certificates spread across hybrid cloud environments, regional IT teams, legacy workloads, and third-party systems. Such blind spots frequently lead to missed renewals and unplanned downtime.
Impact of a certificate outage
Certificate failures are not just operational inconveniences. They occur at authentication boundaries, breaking trust chains and disrupting user logins, service connections, APIs, and dependent systems. The effects can cascade beyond the initial problem.
Recent events illustrate this. In January 2026, an expired code-signing certificate from a manufacturer had caused its macOS configuration apps to stop working. Users had had to reinstall software or apply manual fixes to restore functionality.
This incident underscores how even brief lapses in certificate oversight can cascade into widespread operational disruptions, highlighting the need for proactive lifecycle management.
Navigating the transition
As certificate lifespans shorten, organizations will need systems to automate issuance, renewal, and deployment. This shift calls for clear visibility across all certificates to address risks and maintain compliance.
Practical steps include:
- conducting a complete inventory of certificates and keys
- centralized lifecycle management for issuance and retirement
- integration of automation into development and IT workflows so new systems handle certificates from launch
In some cases, enterprises using centralized and automated certificate processes have achieved substantial returns-on-investment over three years, with payback in under six months, and savings of more than 200,000 hours of manual effort.
By 2029, the challenge will involve managing greater scale. Organizations that adopt automation early can manage renewals as a routine process.
