---
title: "Shorter certificates, stronger security: why SSL renewal is changing"
description: "Public TLS certificates are moving to 47 days. Explore the timeline, the security benefits and how ACME automates renewal across cloud and edge platforms."
canonical_url: https://optimi.com/en/news/47-day-ssl-certificates-acme-cdn
md_url: https://optimi.com/en/news/47-day-ssl-certificates-acme-cdn.md
last_updated: 2026-10-27
---

# Shorter certificates, stronger security: why SSL renewal is changing

The web is moving towards 47-day certificates. Understand the industry decision, the security benefits and the role of automation in keeping every cloud and edge endpoint up to date.

For years, many organisations treated SSL renewal as an annual task: buy a certificate, install it and set a reminder for next year. The industry is moving to a much shorter cycle. **Since 15 March 2026, the maximum lifetime for newly issued public TLS certificates has been 200 days. By 15 March 2029, it will be 47 days.**

The certificates commonly called “SSL certificates” are [TLS certificates](/en/guides/tls-https-web-security). They bind a domain name to a public key, helping browsers authenticate the server when establishing an encrypted connection. Shortening their lifetime changes how long that proof remains valid, with consequences for both security and day-to-day operations.

## What is changing, and who is behind it?

The **CA/Browser Forum** brings together certificate authorities and the companies behind browsers and operating systems, including Apple, Google, Microsoft and Mozilla. It sets baseline requirements for publicly trusted certificates, which browser and operating-system vendors incorporate into their trust policies.

In April 2025, the Forum approved [ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/), proposed by Apple. It introduced a phased reduction in both certificate lifetimes and the age of domain-control evidence that a certificate authority can reuse:

| Certificate issuance date | Maximum certificate lifetime | Maximum domain-validation reuse |
| --- | --- | --- |
| Before 15 March 2026 | 398 days | 398 days |
| From 15 March 2026 | 200 days | 200 days |
| From 15 March 2027 | 100 days | 100 days |
| From 15 March 2029 | **47 days** | **10 days** |

These are the ceilings in the [TLS Baseline Requirements](https://cabforum.org/working-groups/server/baseline-requirements/requirements/); certificate authorities can choose shorter periods. Each cutoff applies to newly issued certificates, including renewals. Existing certificates retain their original expiry dates. The policy covers publicly trusted TLS server certificates; certificates issued by an organisation's private internal authority are outside its scope.

**The 10-day validation limit matters too.** From March 2029, a certificate authority issuing a certificate will need evidence of domain control obtained within the previous 10 days. That means more frequent validation during issuance, rather than certificates expiring every 10 days.

Some authorities are moving faster. [Let's Encrypt plans](https://letsencrypt.org/2025/12/02/from-90-to-45/) to reduce its default certificate lifetime from 90 to 64 days on 10 February 2027, then to 45 days on 16 February 2028. Its opt-in `tlsserver` profile already offers 45-day certificates.

## Why shorter lifetimes improve security

A certificate records a verified situation at a particular moment. Over time, domains change hands, infrastructure moves, private keys can leak and weaknesses can emerge in cryptographic software. The longer a certificate remains valid, the longer its original assurances can outlive the circumstances behind them.

The industry is pursuing four related improvements:

- **A smaller window for misuse.** A wrongly issued certificate, or one whose private key has been stolen, reaches expiry sooner. Rotating private keys during renewal also avoids carrying the same compromised key into a new certificate.
- **Fresher proof of domain control.** More frequent validation reduces the chance of issuing certificates based on outdated evidence, particularly after a domain changes ownership.
- **Less dependence on revocation checks.** Revocation remains necessary, but its effectiveness depends on timely reporting, distribution and client behaviour. Expiry puts a firm time limit on certificate validity even when those mechanisms fall short.
- **Faster security changes.** Frequent replacement helps organisations move away from affected algorithms, keys or certificate chains more quickly when requirements change or weaknesses are discovered.

The security gain comes from fresher evidence and a shorter window of exposure. Reliable automation makes that frequent replacement practical.

## What this means for renewal

At a 47-day lifetime, renewing roughly two-thirds of the way through gives a cadence of about once a month. Across hundreds of hostnames and several platforms, that turns an occasional maintenance task into a continuous operational responsibility.

Every renewal needs to complete early enough to recover from a failed validation or deployment. Domain checks must be repeatable, certificates must reach the right endpoints, and teams need to know when something fails. A calendar reminder and a manual upload become increasingly difficult to sustain.

This is where ACME provides a practical answer.

## ACME: the standard for automated certificate renewal

**ACME stands for Automatic Certificate Management Environment.** Defined in [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555), it is an open protocol that lets software request certificates and prove domain control directly to a certificate authority.

An ACME client can run on your own infrastructure or inside a managed hosting or edge service. It handles the exchange that would otherwise involve requests, validation messages and certificate downloads:

1. **Prove domain control.** The client responds to a challenge from the certificate authority. Common methods use a token served over HTTP or a DNS TXT record.
2. **Obtain the certificate.** After successful validation and the required checks, the authority signs a certificate for the requested names and public key. The corresponding private key stays under the control of the client or hosting platform.
3. **Renew before expiry.** The client requests a replacement certificate, completing fresh validation when required. Scheduling follows the certificate's lifetime or the authority's recommended renewal window, where supported.

The choice of [validation method](https://letsencrypt.org/docs/challenge-types/) depends on the infrastructure. HTTP validation needs the challenge response to be reachable through the relevant routing and security layers. DNS validation proves control independently of the web traffic path and supports wildcard certificates; its automation needs appropriately scoped DNS access or a delegated validation zone.

ACME is widely used by authorities offering free certificates, including Let's Encrypt, and is also available from commercial providers. A trusted free certificate supports the same TLS encryption as a comparable paid certificate. Paid offerings may add organisation validation, support or other services; the benefit of ACME is a standard, repeatable renewal process across compatible providers.

Automation also makes it easier to give each platform certificates limited to the hostnames it serves, with separate private keys. That reduces the impact of a key leaking from one environment.

## From automatic renewal to enterprise-wide deployment

Issuance is one part of the lifecycle. The renewed certificate must also be securely published, activated and checked on the systems that serve it. An integrated client or managed platform can handle that deployment; across providers, it requires coordination with each platform's interfaces and configuration.

**The automated certificate lifecycle**

![An ACME client requests or renews a certificate, proves domain control through a DNS or HTTP challenge, and obtains a signed certificate from a certificate authority. Platform integrations securely publish certificates to CDNs, cloud and edge services, and TLS-terminating gateways. Each endpoint is checked, and the cycle repeats before expiry.](/diagrams/47-day-ssl-certificates-acme-cdn/acme-lifecycle.svg)

*ACME automates validation and issuance. Client or platform integrations complete the lifecycle by publishing certificates to the right endpoints and verifying deployment. Certificates and private keys can be scoped separately to each platform.*

At enterprise scale, managing SSL with ACME can still be challenging: multiple CDNs, edge services and TLS-terminating firewalls each have their own validation paths, access controls and deployment requirements. A successful renewal must reach every endpoint that needs it, including standby infrastructure. **Optimi Console lets you manage the ACME lifecycle across clouds, coordinating secure certificate renewal and publication across your connected platforms.** It brings that multi-provider work together as certificate lifetimes become shorter.

**Prepare for shorter certificate lifetimes**

Talk to Optimi about automating certificate renewal and secure publication across your CDN, cloud and edge infrastructure.

[Talk to the Optimi team](/en/contact)