TLS certificate lifetimes: 200, 100, then 47 days
Public TLS certificates will need renewing more often. List the certificates you use, the teams responsible for them, and the renewal steps that still require manual work.
What changes
The maximum validity of newly issued, publicly trusted TLS certificates decreases in stages. The dates below apply from the day of issuance.
Domain and IP validation can also be reused for less time. This is a separate limit, shown below each certificate lifetime.
- 200 days Domain/IP validation reuse 200 days
- 100 days Domain/IP validation reuse 100 days
- 47 days Domain/IP validation reuse 10 days
What to inventory before the next reduction
- List public certificates from CT logs and compare them with the inventory your teams already maintain.
- Identify internal TLS endpoints that are not visible from the public internet.
- Assign owners to certificates and domains before the renewal window becomes urgent.
- Check which renewal paths are automated and which still depend on a human approval, DNS change, or manual upload.
- Route alerts to the operational channel that can act, not only to a shared security mailbox.
Where Nocert fits
Nocert monitors public and internal TLS certificates and sends expiration alerts according to certificate and endpoint rules. Business and Custom add Compliance findings and timestamped evidence. Your issuance and renewal tools remain responsible for renewing certificates; Nocert checks what is deployed.
Primary source
The schedule above is based on the CA/Browser Forum Baseline Requirements and Ballot SC081v3. Review the current Baseline Requirements directly before making policy decisions, because root program and browser requirements can continue to evolve.