TLS certificates are dropping to 47 days.
The CA/Browser Forum has locked in a schedule cutting the maximum certificate lifetime from 398 days to 47 by 2029. Renewal stops being a yearly chore and becomes continuous — exactly what trstctl automates.
This isn't hypothetical: the first cut already landed — you're on 200-day certificates today. Next is 100 days in 2027, then 47.
Approved, dated, and already counting down.
In April 2025 the CA/Browser Forum approved ballot SC-081v3 — proposed by Apple, endorsed by Sectigo — which halves the maximum certificate lifetime in three steps. Each step also shrinks how long a domain-control validation (DCV) can be reused.
398 days
The old ceiling — one renewal a year, often booked on a calendar reminder. Now history.
DCV reuse · 398 days200 days
Already in effect. Lifetimes are cut roughly in half, and annual workflows have started to slip.
DCV reuse · 200 days100 days
Three-month cycles, now less than a year away. Manual tracking across an estate becomes unsustainable.
DCV reuse · 100 days47 days
Short by design — too short for humans. Validation reuse falls to 10 days, so it must be continuous.
DCV reuse · 10 daysWhat DCV is — and why it's the real squeeze
Domain Control Validation is how a certificate authority confirms you actually control a domain before it issues a cert — the DNS or HTTP challenge you pass. Reuse is how long that proof stays valid before you have to pass it again. Today you can reuse one for over a year; by 2029 it lasts just 10 days, so you re-prove control almost continuously. That cadence is impossible by hand — which is exactly why the change forces automation.
47 days is engineered to break manual processes.
The forum was explicit about the intent: make certificate management impractical to do by hand, so the industry has to automate. Here is what shifts under your feet.
From yearly to every six weeks
A cert good for 398 days renewed once. At 47 days you renew it roughly every six weeks — and because you renew before expiry, even more often. Multiply that by every certificate you own.
Validation goes continuous
DCV reuse drops to 10 days. You can no longer cache a domain check for a year — you re-prove control constantly. That is only sane through ACME-style automation, not tickets.
One miss is an outage
An expired certificate doesn't degrade — it hard-fails: browser errors, broken APIs, dead health checks. Eight renewal windows a year is eight times the chance to miss one.
It's every cert, everywhere
Not just the public web cert. Internal services, load balancers, the long tail nobody owns — plus the SSH keys, secrets, and tokens on the same short-lifetime trajectory.
Make 47-day rotation boring.
trstctl is a self-hosted control plane for non-human identity. The 47-day deadline is the exact problem it was designed around: discover everything, rotate ahead of expiry, prove it, and never hand a robot your CA keys.
Discover every certificate first
You can't rotate what you can't see. Agents and connectors inventory certificates, SSH trust, secrets, and tokens across the hybrid estate — each tied to an owner, source, expiry, and tenant.
Rotate ahead of expiry, idempotently
Policy-driven renewal acts before the deadline, not after the outage. Every operation takes an Idempotency-Key, so a retried renewal can't mint a duplicate or double-issue.
Know the blast radius
The credential graph shows what each certificate reaches and what depends on it — so a renewal (or a miss) has a known impact instead of a surprise.
Prove compliance without a spreadsheet
Every issuance, rotation, and revocation is an immutable event. The audit trail is a replayable projection of product state — exactly what auditors will ask for as cycles shorten.
Automate without surrendering keys
Issuance runs through a separate, isolated signer process. The control plane orchestrates the 8×-a-year churn; private keys never join it. Automation, without losing custody.
47 days is coming whether your renewals are automated or not.
Stand up trstctl locally, point it at your certificates, and make the deadline a non-event.