The Clock Is Ticking: What CA/B Forum’s Ballot SC-081v3 Means for the Future of Web Security

By Manny Fernandez

July 23, 2026

The Clock Is Ticking: What CA/B Forum’s Ballot SC-081v3 Means for the Future of Web Security

If your team manages SSL/TLS certificates using spreadsheets, calendar reminders, or manual renewals, consider this your official wake-up call.

In April 2025, the CA/Browser (CA/B) Forum passed Ballot SC-081v3 , a landmark proposal authored by Apple’s Clint Wilson and sponsored by Sectigo. The ballot lays out a multi-year roadmap that slashes the maximum lifetime of publicly trusted TLS certificates down to just 47 days by 2029.

This isn’t just an incremental policy tweak; it’s a fundamental shift in how the web handles digital trust. Here is everything you need to know about why this passed, what the timeline looks like, and how your team should prepare.

Why Is the Industry Moving to 47-Day Certificates?

To understand why browsers (Apple, Google, Mozilla, Microsoft) pushed hard for this change, you have to look at the vulnerabilities of long-lived certificates:

Revocation is Fundamentally Broken: Traditional revocation mechanisms like CRLs (Certificate Revocation Lists) and OCSP (Online Certificate Status Protocol) have major privacy and reliability flaws. When a key is compromised, browsers often “soft-fail” revocation checks. Shorter certificate lifespans act as a built-in revocation mechanism, even if a key leaks, the maximum window of exposure shrinks dramatically.
Domain Ownership Drift: When domains expire, get sold, or change hands, old certificates frequently remain valid for up to 13 months. Attackers can misuse these orphaned certificates to impersonate brands or execute man-in-the-middle attacks.
Crypto-Agility: When cryptographic algorithms need to be deprecated (as happened with SHA-1 and will eventually happen with post-quantum transitions), 1-year certificate lifespans slow down ecosystem-wide updates.Short-lived certificates allow security standards to update rapidly across the web.
Enforcing Automation: Human error is responsible for the vast majority of certificate outages. By lowering the lifespan threshold, the CA/B Forum is intentionally making manual management operationally impossible, forcing organizations to adopt automated certificate management environments (ACME).

The Phased Timeline: 2026 to 2029

Rather than dropping a 47-day cap overnight, SC-081v3 establishes a progressive reduction schedule to give IT teams time to adapt:

Phase	Effective Date	Max Certificate Lifetime	Max Domain Validation (DCV) Reuse	Renewals per Year
Phase 1	March 15, 2026	200 days (199 effective)	200 days	~2 / year
Phase 2	March 15, 2027	100 days (99 effective)	100 days	~4 / year (Quarterly)
Phase 3	March 15, 2029	47 days (46 effective)	10 days (8 effective)	~8 / year (Every 6–7 weeks)

Why “47 Days”?

Why such a specific number? In automated certificate management, a common practice is to trigger renewals when two-thirds of a certificate’s lifespan has elapsed. On a 47-day lifecycle, renewal happens around day 30, giving systems a generous 17-day buffer to retry and resolve any network or DNS validation glitches before the active certificate expires.

The Real Surprise: 10-Day DCV Reuse

While the 47-day certificate cap grabs the headlines, the real operational challenge in Phase 3 is the reduction of Domain Control Validation (DCV) data reuse to 10 days. Currently, CAs let organizations prove domain control once and reuse that proof for up to a year. By 2028/2029, your systems will need to prove domain control almost continuously (roughly every week and a half).

What Does This Mean for Your Organization?

Note: SC-081v3 applies only to publicly trusted TLS certificates. Private PKIs, internal Active Directory Certificate Services (AD CS), and internal mesh certificates are not bound by CA/B Forum rules.

If your public endpoints (websites, APIs, reverse proxies, edge load balancers, and gateways) rely on public CAs like Let’s Encrypt, DigiCert, Sectigo, or GlobalSign, you must prepare now.

Action Plan for IT & Security Teams

Perform a Discovery Audit: You cannot automate what you cannot see. Map out every public TLS certificate across all domains, cloud environments, and edge appliances.
Transition Away from Manual Workflows: If team members are generating CSRs, completing email/DNS validation manually, and SSHing into servers to install .crt files, those processes will collapse under Phase 2 and Phase 3 workloads.
Standardize on ACME Protocols: Implement ACME (Automatic Certificate Management Environment) or automated Certificate Lifecycle Management (CLM) platforms.
Automate DNS-Based DCV: Because DCV reuse drops to 10 days, programmatic DNS validation (via API-driven DNS providers) will be critical to prevent domain re-validation bottlenecks.

Final Thoughts

Ballot SC-081v3 marks the official end of the “set it and forget it” era for public SSL certificates. While changing operational habits is always challenging, moving toward automated, short-lived certificates reduces outage risks, hardens web endpoints against key misuse, and builds a far more resilient security architecture.

The Clock Is Ticking: What CA/B Forum’s Ballot SC-081v3 Means for the Future of Web Security

Why Is the Industry Moving to 47-Day Certificates?

The Phased Timeline: 2026 to 2029

Why “47 Days”?

The Real Surprise: 10-Day DCV Reuse

What Does This Mean for Your Organization?

Action Plan for IT & Security Teams

Final Thoughts

Recent posts