The CA/B Forum Is Rewriting the Rules of Digital Certificates. Are You Ready?
July 9, 2026
For decades, X.509 digital certificates have quietly underpinned trust on the internet. They authenticate websites, encrypt traffic, secure devices, protect applications, and enable machine-to-machine communication. But that foundation is now undergoing its biggest transformation yet.
Driven by browser vendors, security incidents, operational failures, and the looming reality of quantum computing, the CA/Browser Forum (CA/B Forum) has approved sweeping changes to how public digital certificates are issued, validated, and managed. These changes will reshape how organizations design PKI architectures and force a long-overdue shift toward automation and crypto-agility.
This is not a future problem. The first enforcement milestones arrived in March 2026.
What Is Changing: Shorter Certificates, Faster Rotation
The CA/Browser Forum has approved a phased reduction in the maximum lifetime of publicly trusted TLS certificates. Certificate validity dropped from 398 days today to 200 days in March 2026, and will drop to 100 days in March 2027, and just 47 days by March 2029.
At the same time, Domain Control Validation (DCV) reuse periods will shrink dramatically, reaching just 10 days by 2029. This shift means certificates will need to be issued and rotated 8–12 times per year for every public-facing service.
Why the CA/B Forum Is Forcing This Change
Shorter certificate lifetimes reduce the risk posed by compromised keys, improve the effectiveness of revocation, and eliminate long-standing weaknesses in the Web PKI ecosystem.
More importantly, these mandates intentionally force organizations to abandon manual certificate management in favor of automation and improve crypto-agility across the internet.
The Post-Quantum Cryptography Connection
Quantum computing threatens today’s widely used public-key algorithms such as RSA and elliptic curve cryptography (ECC). Post-quantum cryptography introduces quantum-resistant algorithms designed to address this risk.
Short-lived certificates make large-scale cryptographic migrations feasible by allowing rapid algorithm transitions, hybrid certificate deployments, and reduced long-term exposure.
What This Means for Organizations
Organizations that rely on manual or fragmented certificate management will face increased operational risk, higher outage frequency, and compliance challenges as renewal cycles accelerate.
Certificates must now be treated as short-lived infrastructure assets, managed with the same rigor and automation as secrets, containers, and API credentials.
Why Certificate Lifecycle Management Platforms Matter
As certificate lifetimes shrink and renewal frequency accelerates, traditional approaches such as spreadsheets, calendar reminders, and ticket-driven processes simply do not scale.
Certificate Lifecycle Management (CLM) platforms fundamentally change how certificates are managed operationally—shifting from static, manually handled assets to continuously managed machine identities.
CLM platforms provide centralized visibility across environments by continuously discovering certificates and maintaining an authoritative inventory of usage, ownership, and expiration timelines.
They automate certificate issuance, renewal, and deployment through integrations with certificate authorities, servers, cloud platforms, and DevOps pipelines—eliminating missed renewals and reducing outage risk.
Policy enforcement is embedded directly into the lifecycle, ensuring certificates comply with validity periods, cryptographic standards, and usage constraints before they are ever issued.
As cryptographic standards evolve, CLM platforms reduce the blast radius of change by enabling rapid key rotation, algorithm updates, and future post-quantum transitions without large-scale manual remediation.
By integrating with infrastructure-as-code, CI/CD workflows, and identity systems, CLM platforms align certificate management with modern operational practices.
The result is a shift from reactive firefighting to operational resilience—freeing engineering time, improving security posture, and enabling organizations to adapt quickly as trust requirements continue to evolve.
Machine Identity Is Now a First-Class Security Problem
Certificates now secure far more than websites. APIs, microservices, cloud workloads, devices, secure email, code signing, and internal services all depend on machine identities.
As certificate lifetimes shrink, managing machine identities becomes inseparable from enterprise security strategy and operational resilience.
Final Thoughts
The CA/B Forum’s mandates represent a fundamental shift in how digital trust is managed. Short-lived certificates, forced automation, and crypto-agility are no longer best practices—they are requirements.
Organizations that modernize now will reduce outages, strengthen security posture, and position themselves for a post-quantum future. Those that delay will face growing operational and security risk.