Why are TLS certificate lifetimes getting shorter?

Because shorter lifetimes limit the damage from a stolen key or a wrongly issued certificate, and push everyone to automate renewal. In April 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. certificates, adopted ballot SC-081: the maximum lifetime falls from 398 days to 200 days from 15 March 2026, to 100 days from 15 March 2027 and to 47 days from 15 March 2029. The rules apply to publicly trusted certificates, not to those issued by your own internal CA. For a company still renewing certificates by hand once a year, this changes the workload: renewals become frequent and manual processes will fail. The response is automation through ACME (RFC 8555) or your provider's tools, an inventory of every public certificate and where it is installed, including load balancers and appliances, and monitoring of expiry. Treat it as practice for crypto-agility: the same discipline helps with the post-quantum transition.

← All 40 questions on Encryption and encrypted trafficAll topics