What You Must Know To Keep Your Job

Public TLS certificates are no longer a yearly checkbox. Browser and CA/Browser Forum policy is shortening maximum certificate lifetimes while enterprises multiply issuers (AD CS, ACME, cloud CAs, Java keystores). If you still renew from spreadsheets, you are one missed date away from an outage — and one audit away from explaining why.

How we got here — a brief history

1990s–2000sSSL/TLS secures e-commerce; certificates often valid for multiple years, manually installed on single servers.

2012–2018CA/Browser Forum caps public TLS validity: 60 months → 39 months → 825 days as mis-issuance and compromise drive shorter trust windows.

2020–2021398-day maximum for publicly trusted TLS becomes the norm; Let's Encrypt popularizes 90-day certificates and ACME automation.

TodayHybrid PKI: Microsoft AD CS internally, ACME and commercial CAs externally, plus cloud-native certs (Azure, AWS ACM) — often with no central inventory.

Where policy is going (2026–2029)

Ballot SC081v3 schedules phased reductions of maximum public TLS certificate validity (widely summarized as):

Effective window	Max public TLS validity (industry)	What it means for you
Before ~March 2026	Up to 398 days	Last generation of annual public certs; plan automation now.
2026	~200 days	Renewals at least twice per year unless you automate; DigiCert and others align near 199 days.
2027	~100 days	Quarterly renewal cadence becomes the compliance baseline for public TLS.
2029	~47 days	Monthly-style renewal; manual processes fail at scale.

Let's Encrypt is moving default profiles toward 64-day (2027) and 45-day (2028) certificates, with shorter domain authorization reuse periods — automation is no longer optional for teams using public CAs at scale.

Career survival checklist

Inventory everything — stores, IIS, Exchange, NGINX, Java keystores, Azure apps, AWS ACM — not just the cert on the web server.
Automate renewal and deployment — ACME, AD CS templates, and scripted install to targets; manual MMC is not auditable at 100-day lifetimes.
Monitor live endpoints — expiration alerts alone miss drift (wrong binding, untrusted chain, orphaned cert).
Document ownership — who approves issuance, who receives alerts, who can deploy to production.
Use a platform — Argent TSA combines inventory, monitoring, lifecycle, AD CS/ACME, reporting, PowerShell, and the AI Assistant so one team can answer what expires this quarter in seconds.

Executives remember the outage, not the CA vendor. Operators who deliver centralized SSL automation — before the 200-day and 100-day cliffs — keep their jobs.

TSA Executive Summary Lifecycle Management