Luca BertonThe CA/Browser Forum has adopted a phased reduction in maximum public TLS certificate lifetimes. This isn't government regulation — it's industry rules enforced by the root programs of Apple, Google, Mozilla, and Microsoft. If your CA doesn't comply, browsers stop trusting their certificates. For your infrastructure, the effect is the same as regulation: comply or break.
The Timeline
| Period | Max Certificate Lifetime | DCV Reuse |
|---|---|---|
| Until March 14, 2026 | 398 days | 398 days |
| March 15, 2026 – March 14, 2027 | 200 days | 200 days |
| March 15, 2027 – March 14, 2029 | 100 days | 100 days |
| From March 15, 2029 | 47 days | 10 days |
Critical detail: The limit applies based on issuance date, not purchase date. A certificate issued on March 16, 2026 cannot be valid for more than 200 days, regardless of when you ordered it.
Why This Is Happening
- Shorter compromise windows — A stolen private key is exploitable for the certificate's remaining lifetime. Shorter certificates reduce this window
- Faster revocation — CRL and OCSP revocation mechanisms are unreliable. Short lifetimes make revocation less critical because certificates expire quickly anyway
- Forced automation — Manual certificate management doesn't scale at 47-day lifetimes. This pushes the ecosystem toward ACME and automated lifecycle management
- Crypto agility — Shorter lifetimes mean faster adoption of new algorithms (relevant for post-quantum migration)
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →What This Applies To
- In scope: All publicly-trusted DV, OV, and EV TLS server certificates chaining to public root programs
- Out of scope: Certificates from private CAs, internal PKI, user-added roots, client certificates, code signing certificates, S/MIME certificates
Infrastructure Impact Assessment
Ask yourself:
- How many public TLS certificates does your organization manage?
- How many are renewed manually (portal, email, CSV)?
- Do all your systems support ACME or automated renewal?
- Do you have appliances, IoT devices, or legacy systems with embedded certificates?
- What's your current mean time to renew a certificate?
If any answer involves "manual" or "we don't know," you have work to do before March 15, 2026.
Technical Troubleshooting
Diagnostics, networks, and customer-facing problem resolution. In collaboration with Starweaver.
Start on Coursera →The Action Plan
- Inventory — Discover every public TLS certificate in your infrastructure (today)
- Automate — Deploy ACME-based automation for every certificate that supports it (by March 2026)
- Plan for exceptions — Identify systems that can't use ACME and plan manual processes with shorter renewal cycles
- Monitor — Implement certificate expiration monitoring with alerting (if you haven't already)
- Test — Run renewal drills to verify automation works end-to-end