SC-031: Browser Alignment puts the 398-day cap in the BRs

SC-031 is where the 398-day TLS certificate became a formal CA/B Forum rule. The "Browser Alignment" ballot copied requirements that browser root programs had introduced on their own into the Baseline Requirements, including the cap of 398 days for certificates issued from 2020-09-01.

What changed

SC-031 moved rules that root programs had set on their own into the BRs. The ballot text explains why: root programs had added requirements beyond the BRs, which weren't independently audited and left CAs complying with the union of every program's rules. The best-known one: subscriber certificates issued on or after 2020-09-01 should not exceed 397 days and must not exceed 398 days of validity. Apple had announced this limit for Safari earlier in 2020, after SC-022v2, a ballot for the same limit, failed in 2019. Other changes, effective 2020-09-30, covered OCSP response validity periods, byte-for-byte identical subject and issuer names across certification paths, a required CA/B Forum reserved policy identifier in subscriber certificates, and meaningful reason codes when subordinate CAs are revoked.

Effective dates

The ballot passed on 2020-07-16 and the BR change took effect on 2020-08-20. The 398-day limit applied from 2020-09-01, most other requirements from 2020-09-30.

Who is affected

Everyone buying TLS certificates: two-year certificates disappeared and annual renewal became the norm. It was proposed by Google and endorsed by Apple and Microsoft.

What to do

No action is needed: the 398-day rule ended on 2026-03-15, when SC-081v3 cut the maximum to 200 days. See the certificate validity timeline.