Certificates
Public TLS certificates cap at 47 days
March 15, 2029 · In 881 days
CA/Browser Forum · high confidence · Last verified October 15, 2026
What breaks
Publicly trusted TLS subscriber certificates issued on or after March 15, 2029 cannot be valid longer than 47 days. Domain and IP validation reuse is capped at 10 days on the same date.
Who is affected
- Anyone who issues or installs publicly trusted TLS certificates
- Certificate inventories that still assume a 100-day maximum after 2027
- Validation workflows that reuse domain control proof for more than 10 days
Source notes
BR 2.2.7 lists, effective 2029-03-15, section 6.3.2: the maximum validity period of subscriber certificates is 47 days. Section 4.2.1 on the same date sets domain and IP validation reuse to 10 days.
This is the industry cap. Let’s Encrypt’s February 16, 2028 move to 45 days is earlier and slightly shorter than this 47-day maximum, and it is tracked on its own card.
Certificates issued before the effective date are not shortened by the requirement. The cap applies to issuance on or after that day.
Taken from the effective-date list in Baseline Requirements 2.2.7. Re-check the current Baseline Requirements document if a newer version has been published.
Sources
CA/Browser Forum TLS Baseline Requirements 2.2.7, section 6.3.2 effective dates