SC-022v2: the failed 2019 vote for one-year certificates

SC-022v2 was the CA/B Forum's 2019 attempt to make TLS certificates last about a year instead of up to 825 days. Every browser voted for it, but most certificate authorities voted against, so it failed on 2019-09-10, and browsers then imposed the change on their own.

What it proposed

SC-022v2, proposed by Google, would have reduced the maximum certificate lifetime and the reuse of domain validation from 825 days to an annual cycle, measured precisely in days and seconds (with a one-day allowance) rather than months. Its stated reasons: problems from mis-issuance would be fixed faster, revocation via CRL and OCSP doesn't work at Internet scale, stale certificates for domains that changed owners (the "BygoneSSL" research) would expire sooner, and yearly renewal encourages automation such as ACME (RFC 8555).

Vote result

SC-022v2 failed because only 35% of voting certificate issuers supported it, against the two-thirds needed. Issuers cast 11 yes votes (including Let's Encrypt, Sectigo and Amazon), 20 no votes (including GlobalSign, GoDaddy and Entrust Datacard) and 2 abstentions. Certificate consumers voted 7 of 7 in favor (Apple, Cisco, Google, Microsoft, Mozilla, Opera and 360).

What happened next

In February 2020 Apple announced that Safari and its platforms would reject TLS certificates issued from 2020-09-01 with a validity longer than 398 days; Google and Mozilla followed. SC-031 then wrote the 398-day limit into the Baseline Requirements, and SC-042 aligned validation reuse with it in 2021.

Why it matters

SC-022v2 showed that root programs can enforce a change even when CAs vote it down. The next lifetime reduction, SC-081v3 in 2025, passed without a single no vote and sets the path to 47 days by 2029.