In April 2025 the CA/Browser Forum passed Ballot SC-081, which gradually reduces the maximum validity of publicly trusted TLS (SSL) server certificates. The end state is 47 days, turning certificate renewal from a yearly task into a monthly automated process.
Timeline
| Issued | Maximum validity | Domain validation (DCV) reuse |
|---|
| Before 15 March 2026 | 398 days | 398 days |
| From 15 March 2026 | 200 days | 200 days |
| From 15 March 2027 | 100 days | 100 days |
| From 15 March 2029 | 47 days | 10 days |
The limit depends on the issuance date; certificates already issued are not shortened.
What changes
- More renewals: at 47 days you need roughly 8–12 renewals per year with a safety margin.
- More domain validation: from 2029 validation data can be reused for only 10 days, so almost every renewal needs a fresh DNS or HTTP challenge.
- Manual renewal becomes risky: missed renewals, forgotten reloads and redundant nodes left on old certificates become much more likely.
How to prepare
- Inventory which hosts and devices use which certificates and CAs.
- Automate issuance with ACME (certbot, lego, acme.sh) or managed certificates from your cloud/CDN.
- Automate distribution and reload to every server. In Ansible, use handlers plus
meta: flush_handlers.
- Verify the result from the outside: is the new certificate actually being served everywhere?
- Revisit alert thresholds: "warn at 30 days left" fires constantly for 47-day certificates. Judge by the remaining share of the lifetime instead (e.g. renew when under one third).
Checking with SSL Checker
SSL Checker connects to every address of a hostname, judges by remaining lifetime share, flags servers presenting different certificates and detects renewals. Use the API at the end of your renewal job to confirm that every server serves the new certificate.
curl -fsS "https://sslcheck.nakayumc.com/api/v1/check?host=www.example.com&min_days=30&nocache=1" | jq -e '.result == "pass"'
References
- CA/Browser Forum, Ballot SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods
- CA/Browser Forum, Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates