The industry keeps quoting the 2029 headline — 47-day certificates — but the milestone that actually breaks most estates lands two years earlier. In March 2027, the maximum public TLS certificate life drops to 100 days, and that is the point where quarterly manual renewal simply stops working. If your renewal process still involves a calendar reminder and a human, this is the deadline that matters to you, not the one in the press releases.
The 2027 step is the real deadline.
200-day certificates (already live since March 2026) are survivable by hand. 100-day certificates in March 2027 break quarterly manual cycles. 47-day certificates in March 2029 make automation the only option. The work — inventory everything, put it behind ACME, and alert on renewal failure — needs to be done before 2027, not 2029.
What actually changed, and when
In April 2025 the CA/Browser Forum — the body that sets the rules browsers enforce — approved a ballot (SC-081v3) that shortens the maximum life of a public TLS certificate in three steps. It went to 200 days in March 2026, drops to 100 days in March 2027, and reaches 47 days in March 2029. In parallel, the window during which a certificate authority can reuse your domain-validation proof shrinks on the same schedule, down to just 10 days by 2029. Both halves matter, and the second is the one people miss.
The stated reason is a shorter blast radius. A mis-issued or compromised certificate is dangerous for as long as it lives, and revocation on the open web has never really worked — browsers barely check it. Shorter lifetimes are, in effect, the revocation mechanism the web never had. The side effect is the industry's actual goal: at short lifetimes, manual renewal is mathematically dead, and everyone is forced onto automation.
Why 100 days is the breaking point, not 47
At 200 days a disciplined team can still renew by hand roughly twice a year. At 100 days that becomes a renewal every quarter — and quarterly manual processes are exactly the ones that rot: the person who did it last time has moved teams, the runbook is stale, the calendar reminder gets snoozed. At 47 days it is eight renewals a year per certificate, plus re-proving domain ownership around 35 times a year once validation reuse collapses to 10 days. Email-based validation and hand-placed files are not viable at that cadence. The only practical method left is ACME automation using DNS or HTTP challenges.
So the honest framing is: 2029 is not the hard part. The hard part is 2027, and the hardest part of 2027 is discovering every certificate you actually own before it bites. Teams that audit their inventory now transition cleanly; teams that wait meet the deadline as a series of surprise outages.
What breaks first
It is never the main website — that has been on CDN automation for years and will never see a 47-day renewal happen. The damage is in the long tail: the API subdomain someone pinned to a manually issued certificate; the legacy appliance that needs a certificate bundle uploaded by hand; the partner integration that certificate-pins you; the internal load balancer fed by an annual spreadsheet ritual. Every one of those becomes an outage generator once renewals come due every 100, then every 47, days. The work is inventory first, automation second — and certificate transparency logs will surface the certificates you forgot you had.
Where the CDN carries the load
For the front door, a modern CDN is the easy button. Every serious provider issues and rotates its edge certificates automatically; you will simply never perform a 47-day renewal for traffic that terminates at the edge. That removes your highest-traffic surface from the problem entirely. Two questions still matter, though. First, who controls the private keys — if the provider terminates TLS, your key-custody policy should say whether provider-managed keys are acceptable or you need your own. Second, your origin certificates remain your problem: automate those with ACME from a public or internal CA, because the CDN does not renew what sits behind it.
It is also worth asking a provider how it handles certificate operations as a differentiator — issuance speed, wildcard and multi-domain handling, custom CA support, and whether renewals have ever caused it an incident. In the shortening-lifetime era that has become a fair line item in any RFP, not a footnote.
The ninety-day plan
The order of attack is boring and it works. Inventory every certificate you own, using certificate transparency logs to catch the ones you forgot. Move everything public behind ACME automation, CDN or otherwise. Then handle the ugly tail — appliances, pinned certificates, partner dependencies — each with a named owner and a deadline. Finally, delete the calendar reminders and alert on automation failure instead. Renewal should not be an event on anyone's calendar; a failed renewal should be the only thing that pages someone. Automate before 2027, and 2029 arrives as a non-event.