Under the SC-081v3 proposal approved by the CA/Browser Forum, the maximum validity period for globally publicly trusted SSL/TLS certificates will be shortened in phases. This article explains the policy timeline, its impact on websites, and our recommendations for responding.
一、Background: Why Should Certificate Validity Be Shortened?
On April 11, 2025, the CA/Browser Forum (CA/B Forum) formally approved proposal SC-081v3, setting out a phased schedule to shorten the maximum validity period of globally publicly trusted SSL/TLS certificates. The proposal was submitted by Apple, and all four major browser vendors—Apple, Google, Microsoft, and Mozilla—voted in favor, with 25 certificate authorities in favor, 0 opposed, and 5 abstaining.
The purpose of shortening validity periods is to reduce the risk window caused by private key compromise and mis-issuance, and to some extent replace the insufficiently reliable revocation mechanisms (CRL/OCSP) with rapid expiration.
II. Timeline: Three-Phase Shortening
| Certificate issuance date | Maximum validity period | Domain validation (DCV) information reuse period |
|---|---|---|
| Before March 15, 2026 | 398 days | 398 days |
| From March 15, 2026 | 200 days | 200 days |
| From March 15, 2027 | 100 days | 100 days |
| From March 15, 2029 | 47 days | 10 days |
Currently (October 2026) we are in the 200-day phase; the next milestones are a reduction to 100 days on March 15, 2027, and to 47 days on March 15, 2029.
III. Several details that need attention
- CA actual issuance is usually 1 day less than the maximum.Because validity is accurate to the second, exceeding the maximum by even 1 second constitutes mis-issuance and triggers mandatory revocation. Therefore, DigiCert has issued certificates for 199 days starting February 24, 2026, and Sectigo likewise for 199 days starting March 12, 2026. This is also the source of the “199 days + 199 days” saying.
- The domain validation reuse period is shortened accordingly.Starting March 15, 2029, the CA’s reuse period for domain validation results will be reduced to 10 days, meaning nearly every renewal will require revalidation, and manual operation will be basically infeasible.
- The OV/EV organization information reuse periodis shortened from 825 days to 398 days (starting March 15, 2026).
- Scope not affected:Chinese national cryptographic algorithm (SM2) certificates, private/internal network certificates, and free test certificates (still 3 months) are not subject to this adjustment for now.
IV. Impact on the Site
- Renewal frequency has risen sharply: from once a year to multiple times a year; at the 47-day stage, a single certificate needs to be renewed about 8 times per year.
- Manual management is no longer sustainable: Excel records and calendar reminders are highly prone to being missed under short cycles; once a certificate expires, browsers will flag the site as "not secure" and may even cause business interruption.
- Automation has become a must: certificate discovery, renewal, deployment, and monitoring need to form a closed loop, especially for sites with multiple domains, multiple servers, and multiple environments.
V. Our Recommendations and Arrangements
- Inventory certificate assets as early as possible: Map out the domains, expiration dates, deployment locations, and owners of all public certificates under your name to avoid missing any "shadow certificates."
- Enable expiration monitoring and automatic renewal: Prioritize automatic renewal using the ACME protocol (such as DNS-01 validation), and enable automated deployment.
- Complete automation upgrades before March 2027: Finish before the 100-day phase arrives to leave ample margin for the 47-day phase in 2029.
- HOLYPro SSL Certificate Service: We provide certificate selection, issuance, deployment, expiration reminders, and automatic renewal support to help customers transition smoothly to the era of short-lived certificates. Customers in need can contact us for tailored solutions.
VI. Conclusion
The shortening of certificate validity periods is an established industry direction, and the timeline has already been made clear. We recommend that all sites prepare as early as possible and upgrade the habit of "renewing once a year" to "automatic renewal + continuous monitoring." If you have any questions, please feel free to contact us at any time.
HOLYPro
October 2026