SSL/TLS certificates are crucial for secure communication between systems. To keep them trustworthy, they have to be renewed regularly. Currently, there’s a certificate validity of 200 days, with an even shorter lifetime planned. If you still install certificates by hand, that carries risks. In this blog, we explain what’s changing and how it affects you.
What’s changing, and when
To limit damage when a private key is compromised, the lifetime of certificates is being reduced.
The CA/Browser Forum (Certification Authority/Browser Forum) set a fixed schedule:
- Currently: maximum validity is 200 days
- 15 March 2027: maximum validity drops to 100 days
- 15 March 2029: maximum validity drops to 47 days
Since we provide the certificates and your team installs them, this shorter renewal period is something to monitor closely. Our certificate renewal process itself is fully automated. However, as certificate lifetimes shrink, manual installation is becoming unworkable fast.
Why manual installation is risky
If you still depend on installing certificates manually, you're at risk. Doing everything by hand is error-prone, and a single mistake can lead to a service outage or security gap. With a shortening renewal window, the margin for error keeps getting thinner.
What this means for manual installation
If your systems rely on manually adding our certificate to a trusted certificate store, that may lead to downtime. Instead, you should let your systems validate the new certificate chain automatically (for example, by trusting the issuing root or intermediate CA).
Whether that's possible depends entirely on how your environment is set up.
Mind the deadline
With the new schedule in mind, it's a good time to review your renewal workflow. Certificate lifetimes are getting shorter, and further reductions beyond 47 days are possible in the future.
If you still depend on manual updates, now is the best moment to get your renewal process in order.
Further reading:
