The TLS Certificate Revolution: From 365 to 47 Days of Validity
The CA/Browser Forum approved in April 2025 a drastic reduction in the validity of TLS certificates, with a progressive calendar that will lead to only 47 days of validity from March 2029. The first phase, already active since March 15, 2026, has lowered the limit to 200 days. This transformation makes manual management methods, such as Excel spreadsheets, obsolete and requires a mandatory transition to automation.
Quick Response
TLS certificates will reduce their validity to 47 days from March 2029, with intermediate stages at 200 days (March 2026) and 100 days (March 2027). The reduction aims to improve security and pushes towards complete automation of certificate management. Organizations must prepare with a detailed inventory, domain validation automation, identification of non-SNI traffic, and blast radius isolation.
Why Certificate Validity is Being Reduced
The CA/Browser Forum's decision to reduce the validity of TLS certificates has clear goals: to reduce the vulnerability window in case of stolen or incorrectly issued certificates and to push the ecosystem towards automation. This change was approved with the ballot SC081v3 and involves a gradual transition culminating in 2029 with certificates valid for only 47 days.
The Immediate Impact on Organizations
The reduction in the validity of TLS certificates has a significant impact on IT operations. According to a DigiCert research in collaboration with Omdia, 47% of organizations continue to use manual methods such as Excel spreadsheets to track certificate expirations. This approach is no longer sustainable with renewal cycles that are drastically shortening.
Five Crucial Steps to Prepare for 47-Day Certificates
To address this challenge, organizations must follow a specific checklist. The first step is to create a complete inventory of all certificates, including domains and associated sites. This inventory must include information on who is responsible for renewing each certificate.
Domain Validation Automation
Manual domain validation becomes unsustainable with a 10-day renewal cycle. The solution is automating validation via CNAME. This method not only simplifies the process but makes it continuous. Imperva, for example, already requires domain revalidation every 99 days for its managed certificates.
Identifying Non-SNI Traffic
Server Name Indication (SNI) is a TLS extension that allows the server to identify the host name requested by the client. Clients that do not support SNI, such as outdated HTTP libraries or poorly configured monitoring tools, cannot be served with site certificates. This issue must be addressed before switching to SNI-only mode.
Blast Radius Isolation
Sharing a certificate among multiple sites means that a renewal problem can cause widespread outages. The solution is to use dedicated certificates for each site, such as those offered by Imperva. This practice not only reduces the risk of outages but also simplifies certificate management.
Integration with Existing Management Systems
If certificates are managed through a Certificate Lifecycle Management (CLM) platform or an internal PKI, it is essential to connect these systems directly to the WAF. Imperva, for example, supports integration with DigiCert Trust Lifecycle Manager and Keyfactor Command, facilitating centralized certificate management.
Actions Already Taken by Imperva
Imperva has anticipated industry deadlines, reducing the validity of managed certificates to 90 days with fully automated renewal and distribution. Additionally, the transition of the GlobalSign root from R3 to R46 is managed via a cross-certificate, ensuring continuity for legacy clients until 2029.
The Future Direction of Certificate Management
The reduction in the validity of TLS certificates represents a turning point in IT security management. Organizations must adopt a proactive approach, configuring automated systems that eliminate the need for monthly manual interventions. This change not only improves security but also reduces the risk of operational disruptions.
Frequently Asked Questions
When will 47-day TLS certificates come into effect?
47-day TLS certificates will come into effect from March 15, 2029. The CA/Browser Forum has established a gradual transition with intermediate stages at 200 days (March 2026) and 100 days (March 2027).
How often will domain validation be required?
Domain validation will follow the same certificate validity reduction schedule: 200 days from March 2026, 100 days from March 2027, and 10 days from March 2029. Automating validation via CNAME is essential to manage this process efficiently.
What needs to be done for certificates managed by Imperva?
Imperva automatically renews and distributes managed certificates, which already have a 90-day validity. Users must ensure that domain validation is automated, move SNI sites from shared certificates to dedicated certificates, and update the trust store if pinning to a specific root certificate is done.
What happens to clients that do not support SNI?
Clients that do not support SNI cannot be served with site certificates and will be rejected once the site switches to SNI-only mode. To identify these clients before the transition, you can configure a custom rule with the filter hasSNI == false, set to Alert.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.