47-Day SSL Certificates: What Businesses Need to Know

From 15 March 2029, newly issued, publicly trusted SSL/TLS certificates will have a maximum validity of 47 days. For businesses, that means replacing certificates roughly eight times a year, or more often when renewing ahead of expiry. The change is being introduced gradually, and the first step, the 200-day limit, has been in force since March 2026.

For a website with automated certificate renewal, the transition may require little manual work. On Site.pro, for example, free Let's Encrypt certificates are issued to all clients and added automatically. An enterprise managing certificates across customer portals, APIs, cloud platforms and network equipment faces a different problem: the change exposes weaknesses in how those certificates are tracked and replaced.

What Is Changing?

SSL certificates, more accurately called TLS certificates,help browsers and applications verify a server's identity and establish encrypted connections. Like an identity document, each certificate has an expiry date.

The maximum validity period is shrinking. The period during which a certificate authority may reuse domain and IP address validation data is shrinking on the same schedule:

The limits apply to certificates issued from each date. Certificates already issued are not shortened retroactively, and a certificate may always be issued for less than the maximum.

The change concerns publicly trusted TLS server certificates. It does not automatically impose the same schedule on private certificates issued through an enterprise's internal certificate authority.

Who Is Behind the Change?

The CA/Browser Forum, an industry group bringing together certificate authorities and browser vendors, adopted the change through Ballot SC-081v3 in 2025: 25 of the 30 certificate-authority votes were in favour, the other five abstained, and all four browser vendors voted yes.

Apple proposed the ballot, and Google, Microsoft and Mozilla supported it.

Responsibilities are spread across the ecosystem. Certificate authorities must issue certificates within the new limits. Browser vendors enforce trust requirements through their root programs. Businesses, hosting providers and IT teams must ensure replacement certificates reach the systems that use them.

Why Are Certificate Lifetimes Getting Shorter?

A certificate reflects information checked at the time it was issued. Over time, that information can become outdated: domain control may change, or a private key may fall into the wrong hands.

Shorter validity periods reduce how long a certificate can remain usable after those circumstances change. More frequent validation also reduces reliance on old checks. The CA/Browser Forum identifies limitations in certificate revocation systems as another reason to shorten lifetimes: expiry provides a firm endpoint even when revocation is ineffective.

Shorter lifetimes support security, but organisations still need reliable processes for replacing certificates.

Why Can This Be a Problem for Large Enterprises?

Consider a customer portal whose certificate expires overnight. Visitors may see a security warning. An application connecting to the same service may reject the connection entirely, interrupting transactions or data exchange.

Now consider an enterprise with thousands of certificates managed by different teams. Some sit on cloud services; others are installed on load balancers, gateways or older equipment. Their renewal processes may differ, and responsibility may be unclear.

The shorter schedule makes several operational weaknesses more consequential:

Renewal and deployment are separate steps. A certificate can be renewed successfully while a server continues presenting the expired version. Monitoring only the renewal request can therefore miss the actual service risk.

The Second Change: Validation Data Reuse

Certificate lifetime is only part of the change. A certificate authority may reuse domain and IP address validation information for a limited period, and that period is shrinking on the : same schedule:

This does not mean certificates expire every 10 days. Until 2029 the two limits move together, so a renewal completed before the previous certificate expires can still rely on the earlier validation. From 2029 the reuse window is much shorter than the certificate lifetime, and a typical renewal will require fresh proof of domain control.

A related change already in force: validations of organisation data used in OV and EV certificates can now be reused for at most 398 days, down from 825. Domain-validated certificates are unaffected.

For enterprises, this adds another dependency to the renewal process. If validation requires a DNS change, the certificate team needs a reliable way to coordinate with, or securely automate work through, the team managing DNS.

Digital Certificate Lifecycle Management

Digital Certificate Lifecycle Management (CLM) brings certificate discovery, issuance, renewal, deployment and monitoring into a central process. It helps organisations move beyond scattered spreadsheets and reminders as replacement becomes more frequent.

NicSRS's CLM solution offers automated certificate discovery, domain validation, issuance, renewal and deployment, together with monitoring and risk alerts. Its solution page lists support for multiple certificate authorities and environments such as web servers, cloud platforms, load balancers, API gateways and Kubernetes.

These capabilities address the enterprise challenge at several stages: discovering certificates that might otherwise be overlooked, automating replacements, and monitoring for problems that need intervention.

Before adopting a CLM platform, companies should check which of their systems it can manage and where additional integration is needed. Older equipment may still require manual handling. Automation should also be tested for failure scenarios, including unsuccessful validation or deployment.

What Should Enterprises Do Now?

The 200-day limit is already in effect, the next reduction arrives in March 2027, and the 47-day limit follows in March 2029. Businesses should use this transition period to:

From 2029, certificate management becomes a routine operational task rather than an occasional project. Enterprises that establish a reliable process before the 100-day step in March 2027 will be ready for the 47-day step two years later.