 |
| SSL Certificate Validation till 47 Days. |
- The CA/Browser Forum has finalized a proposal that will change the TLS certificate landscape forever.
- Starting in 2026 and fully enforced by 2029, public TLS / SSL certificates will have a maximum lifetime of just 47 days.
- This major change will significantly impact how Middleware and Infrastructure teams manage web server security, certificate renewal processes, and application availability.
TLS / SSL Certificate Validity Reduction Timeline
|
Effective
Date |
Max
Certificate Validity |
Domain
Validation Reuse |
|
Until
Mar 15, 2026 |
398 days |
398 days |
|
Mar 15, 2026 |
200 days |
200 days |
|
Mar 15,
2027 |
100 days |
100 days |
|
Mar 15, 2029 |
47 days |
10 days |
🕒 Effective Date
The date on which the new TLS certificate rules take effect.
Starting from that date, the updated validity and validation rules must be followed.
📅 Max Certificate Validity
This is the maximum number of days a TLS certificate will remain valid.
After this period, the certificate must be renewed or replaced.
🌐 Domain Validation Reuse
This is the number of days you can reuse domain validation (proving you own the domain).
After this, you’ll need to re-validate the domain again for new certificates.
Impact on Middleware and Infrastructure Teams (OnPrem / Cloud)
- Shorter certificate lifetimes mean Middleware and Infrastructure engineers must shift from traditional, manual certificate management to more automated, robust, and monitored systems.
- The focus must be on securing critical web frontends, load balancers, and backend integrations that rely on TLS encryption.
Web Server and Certificate Management Summary:-
|
Web Server |
Certificate
Format |
Automation
Support |
Middleware
Challenge |
|
Apache
HTTP Server |
.crt, .key
(PEM) |
Yes
(Certbot) |
Reload
needed post-renewal |
|
NGINX |
.crt, .key (PEM) |
Yes (Certbot + plugins) |
Restart/reload required on renewal |
|
IBM HTTP
Server (IHS) |
.kdb, .sth
(CMS format) |
Manual or
scripted |
No ACME
support, import via gskcapicmd required |
SSL Certificate Automation means, ACME (Automatic Certificate Management Environment).
It is a protocol developed by the Internet Security Research Group (ISRG) — the same organization behind Let’s Encrypt.
ACME is designed to automate the entire lifecycle of TLS/SSL certificates, including:
- Issuing new certificates.
- Renewing certificates before they expire.
- Validating domain ownership.
- Downloading and installing certificates.
Conclusion:-
- By 2029, TLS certificates will expire in just 47 days.
- Automate certificate issuance and renewal using ACME ( Using Certbot)
- Use monitoring tools to avoid expiry. (Using Openssl command from bash / .bat script to trigger alert)
