For years, TLS certificate management looked like procurement: buy, install, remember. That model worked when validity was long and estates were simple. The CA/Browser Forum is about to make it obsolete. If your renewal process still starts with a purchase order and a calendar reminder, it is time to look again. As you might know, things are changing.
The new public-certificate timeline is explicit. Maximum validity falls to 200 days from March 2026, drops to 100 days from March 2027, and reaches just 47 days by March 2029. Domain validation reuse tightens alongside it, ending at a 10-day window by 2029.
In practical terms, public TLS renewal becomes a high-frequency operational process, not an annual checkbox. IT leaders should read that as a design challenge.
The hidden scale of certificate sprawl
A 47-day window is manageable for one server. It becomes unsustainable across hundreds or thousands of endpoints. A Venafi 2024 study found that enterprises with 250+ employees manage an average of 3,730 TLS certificates, with only a small share fully automated.
In real architectures, those credentials hide in load balancers, CDNs, API gateways, Kubernetes ingress, VPNs, mail servers, IoT gateways, and legacy applications.
The risk is not theoretical. An expired certificate creates hard failures. Browsers display an error page. API calls and CI/CD pipelines fail at the TLS layer. A certificate on a WAF or API gateway can take down dependent services. In e-commerce, that is lost revenue. In banking, it is a regulatory and customer-trust incident. In public sector, it is a broken citizen service.
Compliance becomes part of the lifecycle
The new baseline also changes responsibility. Private key protection is no longer just good hygiene; it is a contractual and legal obligation. Weak or vulnerable keys can invalidate certificates. Compromised or inaccurate certificates must be revoked within 24 hours. Domain validation is also moving toward stricter, DNS-based methods, with DNSSEC playing a larger role.
From our view, the question is not whether the organization has a certificate vendor. It is whether the organization can continuously prove that every public identity is valid, protected, monitored, and reversible.
From manual renewal to automated lifecycle
In a 47-day world, automation is not an optimization. It is a prerequisite for staying online.
The lifecycle must cover discovery, inventory, validation, issuance, deployment, reload, monitoring, and incident response. ACME supports automated request, validation, issuance, and installation. But ACME alone is not enough. The organization still needs centralized management, DNS planning for TXT and CAA records, service reloads, revocation workflows, and a way to respond when something fails.
Automation can be built on enterprise platforms such as Venafi, Keyfactor, AppViewX, DigiCert TLM, or Sectigo, or on open-source tools such as cert-manager and HashiCorp Vault for cloud-native environments. The platform choice matters less than the operating model: clear ownership, repeatable processes, and continuous alignment with CA/Browser Forum requirements.
Internal PKI is not the story’s end
The 47-day rule applies to public certificates exposed to the internet. But the operational discipline extends inward. Private CAs, internal PKI, and service-to-service certificates still need governance. Teams already stretched by public renewal pressure will not have spare capacity for an unmanaged internal estate.
A practical starting point
The first step is assessment, not software purchase.
Map every public TLS certificate. Identify ownership and exposure. Review domain validation methods. Check key strength and chain health. Trace dependencies at gateways, WAFs, and CDNs. Then design an automation architecture that can sustain short-lived certificates without human handoff.
From there, the roadmap becomes clear: assess, design, implement, and move into managed operation.
For IT leaders, the shift is simple. TLS certificates are no longer a line item to buy. They are a continuous operational service. Organizations that prepare early will convert a compliance deadline into a controlled improvement. Those that wait will face the same transformation under pressure – where the real cost will not be automation, but outage, breach, and regulatory exposure.
Write us on welisten@sorint.com for consultation.