CA/BROWSER FORUM · SSL/TLS INDUSTRY UPDATE

47-Day SSL Certificates Are Coming: Why Monthly Renewals Are the New Standard (Starting Now at 200 Days)

What the CA/Browser Forum's approved certificate lifespan reduction means for your website, and how Tomsher helps businesses stay secure and compliant through every phase.

SSL/TLS certificate lifespans are shrinking, and the countdown has already started. The CA/Browser Forum's Ballot SC-081v3, formally passed on April 11, 2025, approved a phased reduction of maximum public SSL/TLS certificate validity — from the long-standing 398 days down to just 47 days by March 2029. The first step-down already took effect on March 15, 2026, when the maximum certificate lifespan dropped to 200 days.

If you manage a website, e-commerce store, or any business application secured with SSL/TLS, this is not a distant compliance footnote — it's a direct operational shift that changes how often certificates need to be renewed, monitored and deployed. Where annual renewals were once routine, monthly renewals will become the industry standard once the 47-day phase takes effect.

At Tomsher Technologies, we manage web infrastructure, hosting and security for businesses across the UAE and beyond, and SSL/TLS certificate management is a core part of that. This guide breaks down exactly what's changing, why it's happening, and how to prepare your website or application before manual renewal cycles become unmanageable.

What Actually Changed: The Phased Lifespan Reduction

The CA/Browser Forum — the industry body of certificate authorities and browser vendors that sets baseline requirements for publicly trusted SSL/TLS certificates — approved a gradual reduction in maximum certificate validity through the following enforcement schedule:

In short: the industry is moving from one certificate renewal per year to roughly one renewal every 47 days — close to a monthly renewal cadence — by 2029. The 200-day phase already in effect since March 2026 has doubled renewal frequency compared to the previous 398-day standard, and each subsequent step compresses that window further.

Why Is the Industry Moving to Shorter Certificate Lifespans?

A few factors are driving this shift, and understanding them helps explain why automation — not manual tracking — is now the only realistic path forward:

• Reducing the blast radius of compromised certificates. A shorter validity window limits how long a misissued or compromised certificate can be exploited before it naturally expires.
• Preparing for post-quantum cryptography. While not directly caused by quantum computing, frequent certificate rotation builds the operational muscle organizations will need to adopt quantum-safe algorithms quickly once they become available — a concept known as crypto agility.
• Tightening domain validation freshness. Domain Control Validation (DCV) reuse periods are shrinking on the same schedule — from 200 days in 2026 down to just 10 days by 2029 — meaning domain ownership will need to be reverified far more often.
• Forcing the industry away from manual processes. Regulators and browser vendors want certificate lifecycle management to be automated by default, closing the door on the outages caused by forgotten manual renewals.

The Real Risk: Certificate Outages Are Already a Widespread Problem

This change matters because certificate-related outages are already common — and shorter lifespans will only increase the frequency of renewal events, and with it, the risk of a missed one. Industry research cited by Sectigo, drawing on a Security Magazine survey, found that 72% of organizations experienced at least one certificate-related outage in the past year, with 67% facing outages monthly and 45% facing them weekly. A certificate outage happens when a certificate expires or becomes invalid, instantly triggering browser warnings that tell visitors a connection isn't private.

The business impact is immediate: users see a security warning and leave without hesitation, conversions drop, and trust in the brand takes a visible hit. With 47-day certificates, that margin for error shrinks from months to weeks — a delayed renewal that once caused minor inconvenience could soon mean site downtime, lost revenue, or a compliance violation.

What This Means for Website Owners and Businesses

Whether you run a single business website or manage infrastructure across multiple domains, here's what shifts as lifespans shorten:

• Renewal frequency increases sharply — from once a year, to twice a year in 2026, to nearly monthly by 2029.
• Manual tracking becomes unsustainable — spreadsheets and calendar reminders that worked for annual renewals will not scale to an 8x increase in renewal events.
• IT and security teams face a heavier operational load — what was once a background task risks becoming a recurring, time-consuming priority.
• The risk of a missed renewal — and the outage that follows — grows substantially without a systemized renewal process in place.

How to Prepare: A Practical Path Forward

Businesses don't need to wait until 2029 to act. The path to being ready involves the same core steps regardless of your current certificate volume:

1. Full SSL/TLS discovery — build a complete inventory of every certificate in use, both internal and external, so nothing is renewed blind or missed entirely.
2. Vendor and technology mapping — identify every system, server, CDN, load balancer or application that depends on those certificates to function.
3. Automation planning — adopt certificate lifecycle automation (such as ACME-based issuance and renewal) so certificates renew and deploy automatically before expiry.
4. Phased rollout — align your migration to automated renewal with the CA/Browser Forum's own milestones: 200 days now, 100 days in 2027, and 47 days by 2029.
5. Long-term crypto agility — build renewal processes flexible enough to adapt quickly as cryptographic standards evolve in the years ahead.

Does This Apply to Every Certificate?

This requirement applies specifically to publicly trusted SSL/TLS certificates — those issued by a certificate authority chaining to a root trusted by major browsers and platforms. It does not apply to certificates issued by private or internal certificate authorities used within a controlled enterprise environment. However, if your business operates any public-facing website, application, or API, this change applies to you directly.

How Tomsher Technologies Helps You Get Ahead of This Shift

At Tomsher Technologies, we help businesses build, host and secure their web presence — and that includes making sure SSL/TLS certificate management never becomes a point of failure. As renewal cycles compress industry-wide, our approach is built to keep clients ahead of every enforcement milestone rather than reacting after an outage.

• Certificate inventory and audits — we map every certificate across your domains, subdomains and infrastructure so nothing is overlooked.
• Automated renewal setup — we help configure automated issuance and renewal workflows so certificates refresh well before expiry, without manual intervention.
• Monitoring and alerting — proactive expiry monitoring that flags issues long before they become downtime.
• Infrastructure-ready migration planning — guidance on moving from manual, annual renewal habits to a system built for the 200-day, 100-day and eventual 47-day standards.
• Ongoing support as CA/Browser Forum requirements continue to evolve, so your website stays trusted, secure and online.

Key Takeaways

• Maximum public SSL/TLS certificate lifespan dropped to 200 days on March 15, 2026, down from 398 days.
• It will shrink to 100 days in March 2027, and finally to 47 days — near-monthly renewals — by March 2029.
• Domain Control Validation (DCV) reuse periods are shrinking on the same schedule, down to just 10 days by 2029.
• Manual certificate tracking cannot scale to this renewal frequency — automation is now essential, not optional.
• Certificate outages already affect the majority of organizations yearly; shorter lifespans raise that risk further without proactive management.

The shift to 47-day certificates is a structural change to how the internet handles trust and encryption — and it's already underway. Businesses that start automating their certificate lifecycle now, while lifespans are still at 200 days, will be far better positioned than those waiting until the 47-day deadline arrives in 2029.

Want to make sure your website is ready for shorter SSL/TLS renewal cycles? Tomsher Technologies can audit your current certificate setup, identify gaps, and put an automated renewal process in place so your site stays secure, trusted and online — no matter how fast the renewal clock ticks.