# Why are TLS certificate lifetimes getting shorter?

Because shorter lifetimes limit the damage from a stolen key or a wrongly issued certificate, and push everyone to automate renewal. In April 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public TLS certificates, adopted ballot SC-081: the maximum lifetime falls from 398 days to 200 days from 15 March 2026, to 100 days from 15 March 2027 and to 47 days from 15 March 2029. The rules apply to publicly trusted certificates, not to those issued by your own internal CA. For a company still renewing certificates by hand once a year, this changes the workload: renewals become frequent and manual processes will fail. The response is automation through ACME (RFC 8555) or your provider's tools, an inventory of every public certificate and where it is installed, including load balancers and appliances, and monitoring of expiry. Treat it as practice for crypto-agility: the same discipline helps with the post-quantum transition.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/why-are-tls-certificate-lifetimes-getting-shorter

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Are self-signed certificates on internal servers a problem?](https://netsenx.com/en/faq/are-self-signed-certificates-on-internal-servers-a-problem)
- [What is mutual TLS (mTLS)?](https://netsenx.com/en/faq/what-is-mutual-tls)
- [Does a VPN encrypt everything we send?](https://netsenx.com/en/faq/does-a-vpn-encrypt-everything-we-send)
- [How do I find all SSH servers on our network, including forgotten ones?](https://netsenx.com/en/faq/how-to-find-all-ssh-servers-on-the-network)
- [How do I check which servers run an OpenSSH version affected by a new CVE?](https://netsenx.com/en/faq/how-to-check-openssh-versions-against-a-new-cve)