What are 47-Day Certificates: What’s Changing, Why It Matters, and How to Get Ready
The CA/Browser Forum has approved a phased reduction in the maximum validity period for publicly trusted TLS certificates, dropping to just 47 days by 2029 — down from today's 398-day standard. The rollout happens in stages: 200 days starting March 2026, 100 days in 2027, and 47 days by 2029.
The change is a security win (shorter-lived certificates mean smaller windows for attackers to exploit compromised keys), but it also means organizations will need to renew certificates roughly every month — 8-12 renewal cycles per year per certificate instead of just one. For teams still relying on manual renewal processes, that shift makes automation less of a nice-to-have and more of an operational necessity.
This new Keyfactor Education Center article breaks down what's driving the change, the biggest risks of not adapting (think outages, shadow IT certificates, and wildcard cert exposure), and what a modern, automation-ready certificate lifecycle looks like — plus practical first steps for getting your organization prepared well ahead of the 2029 deadline.