CA/Browser Forum’s 47-Day Certificate Roadmap: Full Timeline to 2029

Verified by SSLInsights Editorial Team — Last reviewed: July 2026 | 10+ years covering SSL/TLS security, certificate lifecycle management, and Web PKI standards

Quick Answer

The CA/Browser Forum approved Ballot SC-081v3 in April 2025, setting a phased schedule that reduces the maximum SSL/TLS certificate validity period from 398 days to 47 days by March 15, 2029. The reduction happens in three steps: 200 days starting March 15, 2026; 100 days starting March 15, 2027; and 47 days starting March 15, 2029. Every publicly trusted TLS certificate is affected. Organizations that still rely on manual renewal processes must begin automation planning now, because the 2026 phase is already in effect.

📋 What Is CA/Browser Forum Ballot SC-081v3?

CA/Browser Forum Ballot SC-081v3 is the official policy measure that introduces a phased reduction in maximum SSL/TLS certificate validity from 398 days to 47 days between 2026 and 2029. It also reduces Domain Control Validation (DCV) reuse periods from 398 days down to 10 days by 2029. The ballot passed with 29 votes in favour and zero opposition in April 2025.

⚠️ Practitioner's Note - SSLInsights Editorial Team

Many teams are treating the 2026 deadline as a minor operational tweak. It is not. The 200-day cap already breaks annual renewal workflows. We have reviewed dozens of infrastructure stacks and the single biggest risk is certificate discovery gaps - certificates that were forgotten, never inventoried, and will expire silently. Start your certificate audit before you evaluate any automation tool.

What Exactly Did the CA/B Forum Vote On?

The CA/Browser Forum voted in April 2025 to pass Ballot SC-081v3, a measure originally proposed by Apple and sponsored by Sectigo. All four major browser vendors - Apple, Google, Mozilla, and Microsoft - voted in favour. The ballot received 29 votes in favour and zero votes in opposition.

According to the official CA/Browser Forum ballot record (April 2025), the measure introduces a schedule of reducing validity and data reuse periods for publicly trusted TLS certificates, starting March 2026 and concluding March 2029.

What Is the Full CA/B Forum Certificate Timeline From 2026 to 2029?

The reduction happens across three enforcement dates, each tied to a hard cutoff based on certificate issuance date - not the date an existing certificate was issued.

Why Is 47 Days the Final Number - Not 30 or 90?

The 47-day figure is deliberate. It is short enough to make manual renewal impractical at scale, but long enough for automation systems to operate without excessive overhead. Compared to the current 398-day cycle, it represents an eightfold increase in renewal frequency.

According to CA/B Forum changes (January 2026), the 10-day DCV reuse period means domain validation must occur with nearly every certificate issuance, not just at renewal - removing the last option for semi-manual workflows.

Phase 1: What Changes on March 15, 2026?

The first enforcement date reduces the maximum certificate validity from 398 days to 200 days. Any TLS certificate issued on or after March 15, 2026, must expire within 200 days. Certificates issued before that date retain their original validity until natural expiration.

In practice, most Certificate Authorities began enforcing a 199-day limit before the official cutoff. DigiCert moved to 199-day certificates on February 24, 2026, and Sectigo enforced the same limit from March 12 - both acting ahead of the CA/B Forum deadline to eliminate any risk of misissuance.

For OV and EV certificates, the Subject Identity Information (SII) reuse period also drops from 825 days to 398 days starting March 15, 2026, per DigiCert's transition guidance. This is a separate, often overlooked change that affects enterprise OV and EV certificate workflows.

For a practical guide to error states triggered by certificate misconfiguration during this transition, see SSLInsights' reference on NET ERR CERT AUTHORITY INVALID errors in Chrome.

Phase 2: What Changes on March 15, 2027?

The second phase reduces maximum certificate validity to 100 days. This is the phase where manual management processes break down for most organizations. Quarterly renewals at scale require either automation or a dedicated operations team.

According to Gartner's 2025 Buyers' Guide for PKI and Certificate Lifecycle Management, cited by AppViewX, PKI has become a larger operational challenge than multi-factor authentication for enterprise security teams - and the 100-day phase will intensify this pressure significantly.

The DCV reuse period drops to 100 days in this phase as well. For organizations running multiple domains, this means domain revalidation must be integrated into renewal workflows - not treated as a one-time task.

Phase 3: What Happens on March 15, 2029?

The final enforcement date introduces the 47-day maximum. From March 15, 2029, every newly issued publicly trusted TLS certificate expires within 47 days. The DCV reuse period drops simultaneously to 10 days - meaning domain validation must occur roughly every renewal cycle.

According to CyberArk's analysis of the 47-day impact (October 2025), managing 1,000 certificates at a 47-day cadence generates approximately 48,000 renewal hours per year - a twelvefold increase from current volumes.

Let's Encrypt plans to move to 45-day certificates by February 2028 - one year before the CA/B Forum mandate. This gives organizations using Let's Encrypt a natural test window to validate automation pipelines before the 2029 deadline becomes mandatory.

"The 2029 phase is not the hard part. The hard part is discovering every certificate you actually have. Organizations that audit their certificate inventory in 2026 will transition cleanly. Those that don't will face outages in 2027."

— SSLInsights Editorial Team, June 2026

How Does This Affect Domain Control Validation (DCV) Reuse?

DCV reuse is the period during which a CA can reissue certificates for a domain without requiring re-validation of ownership. This period shrinks alongside certificate validity under SC-081v3, reaching 10 days by 2029.

The practical effect is significant. At 47-day certificate validity with 10-day DCV reuse, domain ownership must be re-proved approximately 35 times per year per domain. Email-based DCV and manual HTTP file placement are not viable at that frequency. ACME protocol automation using DNS-01 or HTTP-01 challenges becomes the only practical method.

For a deeper look at how intermediate certificates fit into this validation chain, see SSLInsights' guide to intermediate certificates.

Does This Apply to Private CAs or Only Publicly Trusted Certificates?

SC-081v3 applies exclusively to publicly trusted TLS certificates - those issued by CAs included in browser root programs such as Apple's, Google's, Mozilla's, and Microsoft's. Private PKI environments, internal CAs, and self-signed certificates are not governed by these rules.

This distinction is confirmed by multiple CA/B Forum members. As noted by FixMyCert's SC-081v3 reference, private CAs should assess their own operational constraints independently rather than automatically adopting public web PKI standards.

However, organizations running internal CAs alongside public certificates still need to plan for the operational asymmetry - different renewal cadences across the same infrastructure introduce coordination risk.

For related background on certificate types and their differences, see SSLInsights' guide to self-signed certificates.

Manual vs. Automated Certificate Management: How Do They Compare?

The table below shows how the same workload scales differently under manual and automated management as validity periods shorten.

The renewal volume numbers above are illustrative. Actual counts depend on domain count per certificate, multi-domain and wildcard usage, and renewal timing offsets. Automation tools using the ACME protocol handle this at constant operational cost regardless of certificate count.

Organizations moving from manual processes can start by reviewing common OpenSSL commands - many ACME clients and CLM tools rely on these commands internally.

Frequently Asked Questions About the 47-Day Certificate Roadmap

When did CA/B Forum Ballot SC-081v3 pass?

Ballot SC-081v3 passed on April 11, 2025, during an official vote in the CA/Browser Forum's Server Certificate Working Group. It received 29 votes in favour and zero votes against, making it one of the most unanimous ballots in the forum's history.

Does the 47-day limit apply to existing certificates?

No. The validity limits in SC-081v3 apply to certificates issued on or after each enforcement date. A certificate issued before March 15, 2026, retains its original validity period until it expires naturally. However, once it is renewed or reissued after the cutoff, the new limit applies.

Will my wildcard or multi-domain SSL certificate be affected?

Yes. The ballot applies to all publicly trusted TLS certificate types - DV, OV, and EV - including wildcard and multi-domain (SAN) certificates. The validity reduction is based on issuance date, not certificate type.

What is the best way to prepare for the 47-day certificate changes?

Start with a full certificate discovery audit to inventory every publicly trusted certificate in your infrastructure. Then evaluate ACME protocol support across your load balancers, web servers, and CDNs. Deploy an ACME client such as Certbot or acme.sh for automated renewal, and set up monitoring alerts tied to expiration dates. Begin this process in 2026 - not 2028.

Is Let's Encrypt moving to 47 days as well?

Let's Encrypt plans to issue 45-day certificates by February 2028 - one year before the CA/B Forum's March 2029 mandate. Let's Encrypt will also reduce its authorization reuse period to approximately 7 hours by 2028. These changes align with SC-081v3's direction while arriving slightly earlier.

What happens if a CA issues a certificate exceeding the new validity limits?

Exceeding the validity limit by even one second constitutes misissuance under CA/B Forum baseline requirements. This triggers mandatory revocation. CAs have historically enforced their own earlier limits - such as 199 days instead of 200 days - to eliminate any risk of accidental misissuance at the boundary.

What Should Organizations Do Right Now?

The first enforcement date - March 15, 2026 - is already in effect. Most CAs began issuing certificates with a 199-day limit in February 2026. If your organization renewed any certificate after that date, you are already operating under Phase 1 rules.

First, audit your certificate inventory. Identify every publicly trusted certificate, its expiry date, and the system responsible for renewal. Second, assess ACME support across your infrastructure. Third, deploy automated renewal using DNS-01 or HTTP-01 validation. Fourth, test your automation pipeline before the March 2027 cutoff - that phase is where manual processes fail at scale.

For a detailed breakdown of how certificate authorities work within this ecosystem, see SSLInsights' guide to Certificate Authorities.

SSLInsights will continue tracking CA/B Forum policy changes, enforcement dates, and CA-specific implementation timelines as the 2027 and 2029 phases approach.

About the Author

SSLInsights.com is an independent cybersecurity resource specialising in SSL/TLS certificates, PKI, and web security. The editorial team has covered certificate lifecycle management, CA policy changes, and encryption standards for over five years. SSLInsights tracks CA/Browser Forum ballots in real time to provide practitioners with accurate, up-to-date guidance.