The benefits of automating certificate management for the 47-day lifecycle
TLS certificate lifecycles are shrinking again and fast. By 2029, the CA/B Forum will require certificates to expire every 47 days. Manual management isn’t sustainable at that pace. Enterprises must adopt automated certificate lifecycle management (CLM) tools to avoid outages, reduce operational burden, and maintain compliance. Solutions like Sectigo Certificate Manager streamline renewals, improve visibility, and enhance agility in the face of growing digital complexity and quantum threats.
For years, the status quo of digital certificate management has allowed many organizations to stick with outdated manual strategies. Some have continued to issue, deploy, and renew SSL/TLS certificates manually even as the value of automation has become abundantly clear.
Resistance to change can be difficult to overcome — but soon, manual solutions will prove a real liability, sparking costly outages and other alarming issues as the pace of certificate renewals picks up considerably.
The main shift driving this transformation? The adoption of a 47-day certificate lifecycle, marking a dramatic drop from the 90-day lifespans previously proposed by Google. Apple made headlines by proposing 47-day validity periods in October of 2024, and, more recently, the CA/Browser Forum followed suit by passing this proposal on April 11, 2025.
This development, although arguably necessary, has brought greater urgency to the quest to adopt an automated certificate lifecycle management (CLM) solution. Some organizations manage to manually keep up with certificate renewals while lifecycles currently span 398 days, but this will no longer be realistic when renewals are required every few weeks.
This adjustment may seem overwhelming, but it reflects evolving cybersecurity challenges that call for reduced windows of vulnerability and the need for crypto agility. By implementing automated solutions, enterprises can not only keep up with the faster pace of renewals, but also, position themselves for success in a quickly changing digital ecosystem that will soon be impacted by the dramatic transformation of quantum computing.
With modern automation tools, adapting to 47-day lifecycles is straightforward. Keep reading for a detailed overview of the shift to 47-day certificate lifespans, and to learn how automated certificate management can streamline this transition.
The 47-day certificate lifecycle timeline
Recognizing that it will take some time for organizations to adapt their certificate management strategies, the CA/Browser Forum has approved a phased approach that encompasses gradual reductions in certificate lifespans before the 47-day lifecycle is in place. This should make it easier for businesses to navigate this transformation without disrupting critical operations.
The ultimate deadline is March 15, 2029, when the maximum validity for public TLS certificates falls to 47 days. In the meantime, two intermediate steps in 2026 and 2027 will ease you into shorter renewal cycles. Key dates include:
March 15, 2026: As the first big shift involving certificate lifespans, this important date will mark the adoption of 200-day validity periods, accommodating what has been described as a "six-month renewal cadence." Essentially, this means that, as of 2026, businesses will renew digital certificates at least twice per year. Also worth noting: 200 days for the Domain Control Validation (DCV) reuse period, as defined in CA/B Forum Ballot SC-081v3, which allows for the reuse of previously confirmed domain control data.
March 15, 2027: Businesses should not get too comfortable with 200-day certificate lifespans, as these will be halved in 2027, extending just 100 days as of March 15th. This will form the basis for three-month renewal cadences. Meanwhile, the DCV reuse period will also span 100 days, as defined in CA/B Forum Ballot SC-081v3.
March 15, 2029: The final shift occurs in 2029, when the maximum certificate lifespan will reach a mere 47 days, accompanied by a 10-day DCV reuse period, as defined in CA/B Forum Ballot SC-081v3.
The benefits of certificate automation in a 47-day world
Certificate automation is always worthwhile, but its importance is increasingly evident as certificate lifespans continue to shrink. Remember: short lifespans are not necessarily problematic — these can spark significant improvements in overall security, but only if they are accompanied by automated solutions that expedite certificate management.
Eliminate downtime from expired certificates
Certificate expiration is already a common side effect of manual certificate management, but these will become even more likely as renewals are expected more frequently. Simply put, IT staff members will not be able to keep up with this faster pace of renewals.
Automation solves this problem, picking up the pace for deployments and renewals while freeing up IT experts to focus on other critical matters. With renewals completed promptly and in a matter of moments, outages become a thing of the past.
Gain full visibility and control over your infrastructure
Digital certificate visibility determines how organizations discover and track certificates across their lifespan and within today's vast IT infrastructure. Without full visibility, organizations may be vulnerable to issues such as unexpected expirations or misconfigured certificates. This can also make it more difficult to demonstrate compliance.
Automated SSL certificate management improves visibility by providing a single-pane-of-glass approach to CLM, complete with centralized dashboards and real-time monitoring. These centralized solutions limit the potential for partial visibility, eliminating blind spots so that organizations maintain a holistic view of the contemporary certificate landscape.
Improve ROI and reduce operational costs
Outages and downtime can be incredibly costly, so the ROI of certificate automation could prove impressive if these issues are eliminated. This can also limit labor expenses, making it possible to deal with higher volumes of certificates without dramatically expanding IT departments. As IT resources are freed from handling repetitive renewals and other certificate tasks, this talent can be dedicated to strategic initiatives that drive impressive value.
Operate securely with less in-house expertise
Senior security personnel may struggle to balance certificate demands with higher-level responsibilities. They need assistance, but previously, junior IT staff just didn't have the knowledge needed to keep the certificate lifecycle functioning optimally.
Automation removes the need for deep PKI expertise in everyday renewals and other routine certificate lifecycle tasks, thereby enabling entry-level professionals to get involved in certificate management. When these workflows are automated, junior employees can contribute without suffering misconfigurations or increasing other risks.
Simplify compliance and audit readiness
From PCI DSS to HIPAA and, increasingly, GDPR, many compliance frameworks influence today's certificate management strategies. Advanced platforms automate alignment with strict standards and regulations while also generating reports to help enterprises navigate both internal and external audits.
Reduce human error and enforce consistency
Manual certificate management is prone to misconfigurations, including everything from certificate name mismatches to weak cipher suites or improper redirects. These issues can make organizations more vulnerable to man-in-the-middle (MiTM) attacks or SSL stripping. Misconfigurations may also stand in the way of compliance efforts, violating key requirements outlined in PCI DSS or HIPAA.
Speed up onboarding and boost team productivity
Manual provisioning can prompt considerable IT bottlenecks, which influence not only the day-to-day workflows of key IT personnel, but also, the onboarding process and the effort to get new talent familiarized with critical IT infrastructure and strategies. Automated certificate management addresses this by streamlining the provisioning process and opening the door to repeatable, easy-to-understand workflows.
The strategic upside of the 47-day certificate lifecycle
While 47-day certificates may initially seem difficult to accommodate, they will ultimately deliver much-needed improvements in security, crypto-agility, and operational agility. These shorter lifespans drastically reduce attack windows and will convince holdouts to finally take the leap and adopt automated certificate solutions, which, in turn, will provide several strategic advantages: namely, improved compliance and swifter responses to emerging threats.
This is all part of the strategic push toward a new digital security ethos, reliant on automation but also using PKI technology to enable a Zero Trust model. Within this setup, PKI will form a critical communication framework while Zero Trust will draw on the power of continuous verification to improve access management. Together, these elevate overall digital security, which is further strengthened via short certificate lifetimes.
Get ahead of the 47-day shift with Sectigo’s automation platform
There are many ways to prepare for the upcoming shift to 47-day certificate lifespans, but few strategies are as impactful as adopting an automation-first certificate lifecycle solution—and that’s exactly what Sectigo delivers. From day one, Sectigo Certificate Manager (SCM) was built as an ACME-native solution to automate the entire digital certificate management workflow, delivering an efficient, agile approach to every phase of the certificate lifecycle.
It supports various technologies to provide true end-to-end automation, automating deployment and installation of certificates across your hybrid and multi-cloud infrastructure, such as servers, applications, load balancers, containers and other critical components. SCM gives you complete visibility through centralized dashboards and seamless integrations. Built for scale, this platform drives rapid ROI and supports high-growth environments with ease.
Explore our CLM solution or plan to see it in action by scheduling a demo. For even more insight, check out our 47-day certificate survival guide.