TLS 200-Day Certificate Limit Is Live: What Changed on March 15, 2026 and What to Do Now

As of March 15, 2026, the CA/Browser Forum's certificate lifetime reduction is no longer a future problem — it's live. Every publicly-trusted TLS certificate issued from this date forward has a maximum validity of 200 days, down from the previous 398-day limit. Domain Control Validation (DCV) reuse also drops to 200 days. If your organization hasn't adapted yet, the clock is already ticking.

This article breaks down exactly what changed, why it matters for regulated enterprises running AI infrastructure, the concrete steps your team should take this week — not this quarter — and the procurement lead time to budget for now if commercial certificate tooling is on your roadmap.

What Changed on March 15, 2026

The CA/Browser Forum — the industry body whose rules are enforced by Apple, Google, Mozilla, and Microsoft root programs — moved to the first phase of its certificate lifetime reduction schedule:

Parameter	Before March 15	Since March 15, 2026
Maximum certificate lifetime	398 days	200 days
DCV reuse period	398 days	200 days
Minimum renewals per year	~1	~2

Key detail: This applies based on issuance date. A certificate issued on March 16 cannot be valid for more than 200 days, regardless of when you purchased or requested it. Certificates issued before March 15 with 398-day validity remain valid until their original expiration.

The Roadmap Ahead

200 days is only the beginning. The full CA/Browser Forum schedule tightens aggressively:

• March 15, 2027: Maximum drops to 100 days (DCV reuse: 100 days) — renewals ~4x per year
• March 15, 2029: Maximum drops to 47 days (DCV reuse: 10 days) — renewals ~8x per year

At 47-day lifetimes with 10-day DCV reuse, manual certificate management becomes physically impossible at any meaningful scale. This is by design — the industry is forcing automation.

Why This Hits Regulated Enterprises Harder

For organizations in financial services, healthcare, or any sector subject to DORA, NIS2, or the EU AI Act, shorter certificate lifetimes compound existing compliance challenges:

• Change management overhead: Every certificate renewal is a change event. Doubling renewal frequency doubles the change management documentation, approval workflows, and audit trail entries required under frameworks like DORA's ICT risk management
• Outage risk in critical systems: NIS2 classifies certificate expiration causing service downtime as a security incident. With 200-day lifetimes, the window for missed renewals shrinks. At 47 days, a single missed renewal can take down production in under 7 weeks
• AI inference endpoints: ML model serving endpoints (TensorFlow Serving, Triton, vLLM) typically use TLS for API security. These are often deployed dynamically and at scale — exactly the type of infrastructure where manual renewal fails first
• Multi-cloud complexity: Regulated enterprises often run across AWS, Azure, and on-premises. Each environment has different certificate management tools, different ACME support levels, and different automation capabilities
• Audit requirements: Shorter validity means more certificate events to log, track, and present during audits. Your PKI telemetry needs to capture every issuance, renewal, and deployment across all environments

Immediate Action Plan: This Week

Don't plan for 47 days yet. Get your house in order for 200 days first:

1. Complete Certificate Inventory

You cannot automate what you haven't discovered. Run a full scan of every publicly-trusted TLS certificate across your infrastructure:

• External scanning: Use tools like sslyze, testssl.sh, or commercial scanners (Qualys SSL Labs, DigiCert CertCentral Discovery) against all your public domains and subdomains
• Internal scanning: Scan internal networks for certificates on load balancers, API gateways, ingress controllers, and service mesh endpoints
• Cloud-native: Query AWS Certificate Manager, Azure Key Vault, and GCP Certificate Manager for all managed certificates
• Kubernetes: List all TLS Secrets and cert-manager Certificate resources across every cluster

2. Classify by Renewal Method

For every certificate, categorize it:

• Automated (ACME/cert-manager): Already handled — verify renewal is set to trigger at 2/3 lifetime (renew at ~133 days for 200-day certs)
• Cloud-managed auto-renewal: AWS ACM, Azure App Service managed certs — verify auto-renewal is enabled and working
• Manual renewal: These are your risk. Document each one, assign an owner, set calendar reminders at 60 days and 30 days before expiry
• Legacy/embedded: Appliances, IoT devices, firmware-embedded certs — these need a dedicated migration plan

3. Deploy ACME Automation Where Missing

For every manually-renewed certificate that supports automation:

• Kubernetes: Deploy cert-manager with ClusterIssuer resources pointing to your CA of choice
• Traditional infrastructure: Deploy certbot, acme.sh, or lego with cron-based renewal
• Load balancers: F5, HAProxy, NGINX — most support ACME or have automation hooks for certificate deployment
• CDN/edge: Cloudflare, Fastly, Akamai all manage certificates automatically — verify your configuration

4. Set Up Monitoring and Alerting

Certificate expiration monitoring is no longer optional:

• Prometheus + blackbox_exporter for TLS endpoint monitoring
• cert-manager metrics for Kubernetes certificate health
• Alert thresholds: 30 days (warning), 14 days (critical), 7 days (page on-call)
• Dashboard showing all certificates, their expiration dates, and renewal method

What About Centralized PKI Management?

The DigiCerts and Sectigos of the world are positioning centralized PKI platforms as the answer — and for large enterprises, they're not wrong. A centralized platform gives you:

• Single pane of glass: Every certificate across DNS zones, cloud accounts, and on-premises infrastructure in one inventory
• Automated lifecycle: Issuance, renewal, deployment, and revocation without human intervention
• Compliance reporting: Audit-ready logs of every certificate event, mapped to your compliance framework
• CA abstraction: Swap CAs without changing your automation — critical for resilience

However, centralized platforms are not the only option. Open-source tooling like cert-manager (Kubernetes), step-ca (private CA), and Vault PKI (HashiCorp) can achieve similar results for organizations willing to invest in the engineering.

The right choice depends on your scale, team capabilities, and compliance requirements. An organization managing 50 certificates has different needs than one managing 5,000.

The Sovereignty Dimension

For European enterprises subject to digital sovereignty requirements, certificate management intersects with data residency:

• CA selection matters: Where is your CA headquartered? Where are their validation servers? For GDPR and sovereignty-sensitive environments, European CAs like Buypass (Norway) or HARICA (Greece) may be preferred
• DNS validation: ACME DNS-01 challenges require DNS API access. Ensure your DNS provider supports automation and that API credentials are managed according to your security policies
• Private CA for internal services: For service-to-service communication within your infrastructure, consider a private CA (step-ca, Vault PKI) that keeps all certificate operations within your sovereignty boundary

Preparing for 100 Days (March 2027)

Once you've handled the 200-day transition, start planning for the next phase:

• Eliminate all manual renewals — At 100-day lifetimes (~4 renewals/year), manual processes become unsustainable even for "a few" certificates
• Test renewal frequency — Set your current automation to renew at 67-day intervals (simulating 100-day lifetime with 1/3 remaining). Verify everything works
• Plan ACME for holdouts — Legacy systems that "can't do ACME" need a migration path by March 2027. Reverse proxies, sidecar containers, or certificate relay services can bridge the gap
• Budget for tooling — If you need a commercial PKI platform, the procurement cycle for enterprise software is 3-6 months. Start now

What Open Empower Can Do

As an AI infrastructure partner for regulated enterprises, we help organizations build certificate lifecycle automation into their platform engineering:

• Certificate discovery and inventory across multi-cloud and on-premises infrastructure
• ACME automation deployment with cert-manager, Vault PKI, or commercial CA integration
• Monitoring and alerting setup with Prometheus, Grafana, and PagerDuty integration
• Compliance mapping — Certificate management controls mapped to DORA, NIS2, and AI Act requirements
• Renewal drills — Simulated CA outage and certificate expiration testing

The 200-day limit is live. The 100-day limit is 12 months away. The time to automate is now — not when the next deadline hits.