The first short-lifespan TLS renewal wave is closer than it looks

If your organization runs anything on the public internet, a mandate that changes how often you renew TLS certificates is already in effect. In March 2026, the maximum validity of public TLS certificates dropped from 398 days to 200. What fewer teams have worked out is that the first certificates issued under the 200-day cap start expiring at the end of September. That makes this autumn the first real test of whether your renewal workflows are ready for what the next three years will ask of them.

What the mandate says

The schedule comes from ballot SC-081v3, passed by the CA/Browser Forum, the industry body where certificate authorities and browser vendors set the rules of public trust. Maximum certificate validity dropped from 398 days to 200 in March 2026. It drops again to 100 days in March 2027, and settles at 47 days in March 2029. There's no opt-out and no regional carve-out, because browsers enforce the limits through their root programs, so the schedule applies to every publicly trusted certificate no matter which certificate authority (CA) issues it.

The reasoning behind this is that a shorter lifespan shrinks the window during which a compromised or misissued certificate can be abused, and it moves the whole ecosystem toward automated renewal. For the teams doing the work, though, the practical meaning is a steady rise in renewal frequency. A certificate that used to renew once a year renews about twice a year under the current 200-day limit, four times a year from 2027, and roughly eight times a year once the 47-day limit arrives. An estate of 3,000 certificates that generated 3,000 renewal events annually will generate around 24,000.

Why October matters

Because the 200-day limit took effect in mid-March, certificates issued under it start reaching the end of their lifespan in late September and early October. This will be the first time the industry renews at the shortened cycle all at once, and it's worth treating as a preview of the coming years rather than a one-off inconvenience.

What the wave will surface, for most teams, is the difference between the parts of the estate that renew themselves and the parts that still depend on a person. If you already use ACME with your web servers, those will be fine. You've effectively been living with 90-day certificates for years, and that track record is a large part of why the industry was confident this mandate would work. The pressure shows up in the places ACME typically doesn't reach, such as load balancers, application keystores, network appliances, and older internal services. Those are usually renewed manually, and they're where expiry-related outages tend to originate.

How to tell if you're ready

Three questions give you a fair picture before the wave arrives.

First, how is your certificate inventory produced? If it comes from regular network scanning, you're in good shape. If it's a spreadsheet maintained by hand, it only reflects what someone knew the last time they updated it, and any certificate missing from it carries an expiry date nobody is tracking.

Second, what share of your renewals are automated end to end, meaning issued, deployed, and validated without a manual step? The web tier usually scores well here, so the more useful version of the question is about everything behind it.

Third, how long does one manual renewal actually take once you count the request, the approvals, the deployment, and the change ticket? Multiply that by your certificate count and the new renewal frequency, and you'll see whether the process still fits inside the hours your team has. For many organizations, it stops fitting somewhere between the 2027 and 2029 milestones, which is useful to know now rather than then. Sometimes, this can impact business costs without you realizing.

What to do if you're not

None of this needs to be perfect by October. The autumn wave is a comparatively gentle test at 200 days, and its real value is telling you exactly where your gaps are while there's still time to close them. The teams that use it that way will meet the 100-day cut in March 2027 as a routine and the 47-day limit as a non-event.

Start with discovery—scanning the full network rather than just the endpoints you already know about—since the goal is to find the certificates that aren't on anyone's list. Then extend automation to the segments that don't have it yet. A certificate life cycle management platform such as ManageEngine Key Manager Plus handles that layer, covering discovery through automated renewal and deployment across public and private CAs, including the devices ACME doesn't reach.