TLS certificate lifetimes drop to 100 days in March 2027: what breaks first

The schedule, and where it came from

The CA/Browser Forum approved ballot SC-081v3 in April 2025 with 29 votes in favour and none against, after Apple proposed a staged reduction in publicly trusted certificate lifetimes. The current maximum of 398 days, set in 2020, gives way in three steps: 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15.
The same ballot shortens how long a completed domain validation can be reused, from 398 days down to 10 days by the end of the schedule. That second change is the one that reshapes operations, because it removes the option of validating once and reissuing repeatedly from the cached result.

What actually fails

Certificate expiry is a familiar outage with a familiar monitoring pattern: a dashboard that counts days remaining. The shorter the lifetime, the less useful that pattern becomes, because the gap between a renewal failing and the certificate expiring shrinks from months to a week or two.
The failure mode moves from expiry to silent renewal failure. A renewal job whose credentials expired last quarter, an ACME client that stopped running after a container base image changed, and a DNS challenge that broke when a zone moved to a different provider all produce the same result: a certificate that looks fine until it does not.

What the shorter cycle does to change management

A 100-day certificate that must be revalidated every 100 days turns certificate issuance into a routine, high-frequency change. Manual approval for each issuance stops scaling well before the 47-day stage, and an approval queue becomes the outage risk rather than the control.
That reframes the governance question. Instead of approving individual certificates, teams approve the automation and the account boundaries it runs within: which DNS zones the automation may write, which certificate authorities it may request from, and who is paged when issuance fails. The audit artefact becomes the pipeline configuration and its logs.

Practical steps

Build a certificate inventory that includes internal services and non-HTTP protocols, because those are the ones without a renewal agent. Move to ACME, monitor issuance failures rather than expiry dates, and alert when a renewal has not succeeded inside its expected window.
Test the renewal path before you need it, including the DNS challenge and the deployment step, and record how long a full cycle takes. Then find the certificates that cannot be automated: an appliance with no API, an air-gapped system, a partner who uploads a certificate by email. Those need a documented owner and a reminder interval now, before the lifetime drops.

References

1. InfoQ: SSL and TLS certificate lifetimes shrink to 47 days by 2029
2. GlobalSign on the move from 398 days to 47 days
3. Tianwei Chengxin on ballot SC-081 and the staged reduction
4. Tencent Cloud developer article on preparing for shorter certificate lifetimes
5. China Industry Economy Information Network: enterprise challenges as certificate validity shrinks