From today until March 15, 2026, the maximum lifetime for a TLS certificate is 398 days.
As of March 15, 2026, the maximum lifetime for a TLS certificate will be 200 days.
As of March 15, 2027, the maximum lifetime for a TLS certificate will be 100 days.
As of March 15, 2029, the maximum lifetime for a TLS certificate will be 47 days.
What’s everyone’s opinion on this? I think from a security standpoint their reasoning is valid and in many cases it’s very easy to automate the renewal with ACME or something else. But there’s likely gonna be legacy stuff still around in 2029 that won’t be easy to automate.
This will be so much fun for people with legacy systems
Self signed certs about to get even more popular.
Tony Stark was able to build his CA in a cave! With a bunch of dice!
This way it will gradually ramp up the pain tho. If they went straight to 47 days, basically the entire internet would be gone for a few days.
I can’t wait for the day when we have to refresh them hourly.
ephemeral single use certs when?
My little corner of the business has started migrating our certs to let’s encrypt.
Hope it catches on else where
If I understand this correctly, it only affects certificates issued by public CAs (certificates for public websites, for example). So for certs issued by a company CA (e.g. for internal infrastructure), it should not apply. Can anyone confirm?
True. Technically the bounds for the validity period are from Jan 1, 1950 to Dec 31, 9999.
The browser warning appears even for a cert issued by a non public CA you have told your browser to trust, and most browsers already enforce a 398 day limit, so unless you have cooperative users, you’re already (effectively) capped at 1 year of validity.
No, that’s fortunately not correct. TLS certificates issued by our CA are valid for 2 years and that works perfectly fine in all the browsers I have ever used.
TLS? Noobs. All the cold kids just cleartext it.
Doesn’t really affet me much, as my LE cronjob will update the cert either way. Doesn’t really matter if it’s 90 days or 47 (what a weird number of days)
I only can assume: 1.5 months rounded up, using 31 days a month 31+16=47
So you get half a month to realize that your monthly automated renewal is broken?
I like it. This action is inevitable in my opinion, and there will always be legacy systems regardless of the timeline, better start sooner than later.
Digicert is such a shitty CA.
Oh, I agree. This change will affect all CAs however. And their post seemed to contain the most amount of information.
I just had to get it out of my system.
deleted by creator
