By 2029, your SSL certificate will expire every 47 days. Is your infrastructure ready?
SSL certificates are the backbone of website security — they encrypt data, build user trust, and keep your services compliant. But the rules around them are changing fast.
Industry authorities have approved a phased reduction in SSL certificate validity periods, moving from 398 days today down to just 47 days by 2029. For teams still managing certificates manually, this is a wake-up call. For those on AWS, it’s an opportunity to let automation handle it entirely. This guide breaks down what’s changing, why it matters, and exactly how to prepare.
Understanding SSL Certificates
An SSL (Secure Sockets Layer) certificate is a digital credential that encrypts the data exchange between a user’s browser and your server. Websites with SSL certificates are identified by HTTPS in the URL and a padlock icon in the browser’s address bar.
As of early 2026, the maximum validity period for publicly trusted SSL certificates is 398 days. However, this is about to change significantly.
The CA/Browser Forum, through Ballot SC-081, has approved a phased reduction in maximum certificate validity:
| Effective Date | Maximum Validity Period |
|---|---|
| March 15, 2026 | 200 Days |
| March 15, 2027 | 100 Days |
| March 15, 2029 | 47 Days |
You can review the official record at CA/Browser Forum Ballot SC-081v3.
By March 2029, certificates will need to be renewed roughly every 1.5 months.
Key Benefits of SSL
SSL certificates are not just a technical requirement — they deliver real business value:
- Data Protection: Encryption prevents unauthorized parties from reading data during transmission.
- Trust & Credibility: Users are more likely to trust and interact with websites that display the security padlock.
- SEO Benefits: Search engines, including Google, prioritize HTTPS-enabled websites in their rankings.
- Phishing Prevention: SSL helps verify the identity of the website, protecting users from landing on fraudulent sites.
How the New Renewal Rules Work
The shift toward shorter validity periods is driven by three core principles:
- Enhanced Security: Shorter lifespans limit the window of opportunity for attackers to exploit a compromised certificate or stolen private key.
- Cryptographic Agility: More frequent renewals allow the industry to adopt new security standards and algorithms faster.
- Driving Automation: Renewing every 47 days is practically impossible to manage manually at scale — this change essentially mandates automated certificate management.
Note on the “90-day rule”: While Google has proposed a 90-day limit independently, the industry is currently following the phased schedule set by the CA/Browser Forum (100 days by 2027, 47 days by 2029).
Business Use Cases for AWS ACM
For infrastructures hosted on AWS, the AWS Certificate Manager (ACM) is the most practical solution to these evolving requirements.
Key Capabilities
- Managed Auto-Renewals: ACM automatically renews certificates integrated with AWS services like Application Load Balancer (ALB), CloudFront, and API Gateway — no manual intervention needed.
- No Additional Cost: Standard public SSL certificates issued through ACM for use with AWS services are provided at no extra cost.
- Exportable Certificates (New): As of June 2025, AWS ACM supports exportable public certificates. You can now export the certificate, certificate chain, and private key for use on workloads outside ACM-integrated services — such as on-premises servers or custom EC2 setups.
- Eliminate Manual Tracking: AWS manages the full certificate lifecycle, removing the need for administrators to track expiration dates.
- Seamless Integration: Certificates can be selected directly within the configuration of ALB, CloudFront, API Gateway, and other AWS resources.
Pricing Note: Standard ACM certificates are free. Exportable public certificates are subject to a fee. See the AWS Certificate Manager Pricing page for current rates. Export capability must be enabled at the time of issuance.
Real-World Use Case
Scenario: A mid-sized e-commerce company runs its storefront on AWS behind an Application Load Balancer, with a few microservices on on-premises servers.
Before ACM: Their team manually tracked 12 certificates across environments. With the new 47-day limit approaching, that means renewing a certificate roughly every week across the fleet — a full-time job on its own.
After ACM:
- ALB and CloudFront certificates are handled entirely by ACM — zero manual effort.
- On-premises services use ACM’s new exportable certificate feature, pulling renewed certs automatically via a script.
The team went from spending hours per month on certificate management to spending zero.
Business Impact of Not Automating
For organizations still relying on manual processes, the new rules introduce serious risks:
- Service Downtime: An expired certificate immediately breaks HTTPS, showing security warnings to users and effectively taking your site offline.
- Revenue Loss: Even a few hours of downtime during peak traffic can result in significant lost sales and damaged reputation.
- Increased Overhead: Renewing every 47 days across multiple environments requires constant monitoring and administrative effort.
- Compliance Risk: Expired certificates can trigger compliance violations in regulated industries like finance and healthcare.
The cost of not automating far outweighs the effort of setting it up once.
How Operisoft Helps
As an AWS Advanced Consulting Partner, Operisoft specializes in helping businesses modernize their cloud infrastructure and security.
Our team can help you:
- Audit all active SSL certificates across your environments and identify gaps.
- Migrate eligible certificates to AWS ACM for fully automated renewals.
- Configure exportable certificate workflows for on-premises or hybrid setups.
- Monitor certificate health and set up alerts to prevent any future expiry surprises.
Navigating the 2026–2029 SSL changes doesn’t have to be complex. We handle the technical heavy lifting so your team can focus on what matters.
Contact Operisoft today to future-proof your website security.
Conclusion
The move toward shorter SSL lifetimes signals a future where web security is automated by default. The 2026–2029 timeline is aggressive, but the tools to handle it already exist.
Your 3-Step Action Plan
☐ Step 1: Audit and list every SSL certificate currently in use by your team.
☐ Step 2: Identify certificates that can be migrated to AWS ACM for automatic renewal.
☐ Step 3: Consult with Operisoft to implement automated workflows and ensure zero-downtime transitions.
