CA/B Forum ballot · SC-081v3
SC-081v3: TLS certificate lifetimes drop to 47 days by 2029
Details
- Ballot
- SC-081v3
- Title
- Introduce Schedule of Reducing Validity and Data Reuse Periods
- Status
- Passed
- Date
- 2025-04-11
- Adopted
- Effective
- BR version
- 2.1.5
- Official page
- cabforum.org
Key dates
- Max validity 200 days; domain/IP validation reuse 200 days; subject identity reuse 398 days
- Max validity 100 days; domain/IP validation reuse 100 days
- Max validity 47 days; domain/IP validation reuse 10 days
SC-081v3 is the ballot that ends the one-year TLS certificate. It sets a schedule that lowers the maximum validity of publicly trusted TLS certificates from 398 days to 200 days on 2026-03-15, 100 days on 2027-03-15 and 47 days on 2029-03-15, and shortens how long a CA may reuse domain validation to 10 days by 2029.
What changed
SC-081v3 rewrote two parts of the Baseline Requirements: the maximum certificate lifetime (§6.3.2) and the data reuse periods (§4.2.1). Before it, a certificate could live 398 days, domain and IP address validation could be reused for 398 days, and validated organization details for 825 days. The ballot was proposed by Apple and endorsed by Sectigo, Google Chrome and Mozilla. The argument in the ballot text: shorter lifetimes limit how long a mis-issued or compromised certificate stays usable, and they push everyone toward automation.
Effective dates
SC-081v3 lowers both limits in three steps, by certificate issue date:
| Issued on or after | Max validity | Domain/IP validation reuse |
|---|---|---|
| until 2026-03-14 | 398 days | 398 days |
| 2026-03-15 | 200 days | 200 days |
| 2027-03-15 | 100 days | 100 days |
| 2029-03-15 | 47 days | 10 days |
Subject identity information (the organization data in OV and EV certificates) may be reused for 398 days from 2026-03-15. As of November 2026 the first step is already in force.
Who is affected
Every publicly trusted TLS server certificate is covered, whether DV, OV or EV, free or paid. Certificates already issued keep their original expiry date; the limits apply to the issue date. Private PKI and internal CAs are not covered. Operators who install certificates by hand, appliances that need a manual upload and contracts that assume yearly renewal feel it most. Sites using ACME clients that renew every 60 days or so are mostly unaffected until the 47-day step.
What to do
Automate renewal now: use an ACME client such as certbot or acme.sh, or your provider's managed certificates, and alert on expiry with a monitor. Check that your renewal job also reloads the web server. Because domain validation will only be reusable for 10 days from 2029, prefer validation methods your automation can repeat, such as DNS-01 with an API-driven DNS provider. See the certificate validity timeline for the history from 5 years to 47 days.