Changes to Maximum Certificate Validity

The CA/Browser Forum has approved shorter maximum lifetimes for publicly trusted TLS/SSL certificates. These limits apply to certificates issued by all publicly trusted certificate authorities (CAs). The main push for these changes has come from Apple.

The advantage of shorter lifespans for certificates is the security improvements. It is likely to lead to the eventual removal of OCSP and much smaller CRLs both checks which can slow down browsers.

The CA/Browser Forum maximum validity periods are as follows:

Ultimately this will lead to a major push to automate certificate issuance. We already offer an API to allow customers to automate the ordering and delivery of their HTTPS/TLS certificate. Some customers have integrated with the console to complete the automation process and can continue to use our existing API to request, download and install certificates.

We are developing in partnership with our providers a process using the ACME protocol and we will be making this available to customers and resellers. The ACME protocol will allow for the complete automation of certificate issuance. This will be provided via a CaaS (Certificate as a Service) subscription.

Some providers like DigiCert are also implementing their own automation system. We are in the process of reviewing the opportunity to provide this product to customers and resellers.

Your certificate plan remains valid until the order expiry date. Individual certificates expire sooner and must be reissued and installed before they expire. We will offer customers with long-term certificate plans the opportunity to transition to the CaaS model.

Frequently Asked Questions

What if I buy a multi-year certificate?

If you buy a certificate with an order validity of 3 years you will be able to reissue the certificate multiple times at no additional cost throughout the order validity period. Each certificate expires at the applicable CA validity limit at the time of issuance or the order expiry date, whichever is sooner. Reissue and install a replacement before each certificate expires to use the full plan period.

Will there be any price changes?

We have no plans to update the existing product prices beyond potential inflation rises later in the year depending on what our suppliers do. There will be no price changes for longer or shorter certificates. Customers can still purchase a one year certificate and reissue it at no additional cost.

What if I am unable to automate the installation of my certificates?

We understand some customers have legacy systems which cannot be automated. The installation process will either need to be completed manually more often or if the certificate does not need to be publicly trusted we can provide alternative solutions such as Certificate Lifecycle Management products that allow the tracking and issuance of private certificates. Contact the sales team regarding these options.

I have certificates I install on thousands of IoT devices. How can I manage renewing these every 47 days?

This depends on whether the devices require public trust. If they are part of your internal infrastructure then there are alternative solutions where longer validity certificates can be issued or full automation can be provided. Contact the sales team regarding these options.