What is the 47-day certificate rule?
The 47-day rule is a CA/Browser Forum decision that cuts the maximum validity of public TLS certificates in three steps: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. After each date, certificate authorities may not issue certificates that last longer.
The schedule
| Certificates issued from | Maximum lifetime | Domain validation reuse | Renewals per year |
|---|---|---|---|
| Before 15 March 2026 | 398 days | 398 days | About 1 |
| 15 March 2026 | 200 days | 200 days | About 2 |
| 15 March 2027 | 100 days | 100 days | About 4 |
| 15 March 2029 | 47 days | 10 days | About 8 |
The schedule was adopted in April 2025 as ballot SC-081v3 of the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for publicly trusted certificates. It applies to every public CA.
The limit applies on the date a certificate is issued. A certificate issued on 14 March 2027 can still run for 200 days; one issued a day later cannot exceed 100. Nothing already installed is cut short.
How to read the calculator
- Maximum lifetime is the cap in force on the issue date you chose.
- Latest expiry is that date plus the maximum lifetime.
- Renew by is the point where one third of the lifetime remains. Automated clients renew around here, and it is where NetworkAI raises a renewal-failure alert if no new certificate has appeared.
- Renewals per year is how often the process must run for one certificate renewed at that point. Multiply by the number of certificates you manage for the yearly workload.
- Validation reuse is how long a CA may rely on a previous proof that you control the domain before you must prove it again.
What changes for your team
Manual renewal stops being realistic. Buying a certificate, validating the domain and installing it by hand is tolerable once a year. At 47 days it is a recurring task for every certificate, and one missed cycle is an outage.
Domain validation has to be automated too. From March 2029 a CA can reuse a domain validation for only 10 days, so in practice every renewal re-validates. Email-based and manually uploaded validations no longer fit; ACME with an HTTP or DNS challenge does.
Fixed-day expiry alerts stop working. A "30 days before expiry" alert on a 47-day certificate is active for most of the certificate's life. An alert that is always on tells you nothing. What matters is whether the renewal that should have happened did happen.
Failures surface faster. A broken renewal job on an annual certificate can sit unnoticed for months. On a 47-day cycle the same fault produces an outage within weeks.
How to prepare
- List every certificate you have and note which are installed by hand. Those are the ones at risk.
- Move them to an ACME client such as Certbot, acme.sh, Caddy or your platform's built-in automation.
- Check that anything certificate-pinned — mobile apps, partner integrations, appliances — can cope with frequent rotation.
- Replace day-count alerts with monitoring that detects a renewal that did not happen.
- Check where an existing certificate stands with certificate lifetime readiness.
Certificates from a private or internal CA are not covered by these rules. Only publicly trusted certificates are.
Private by design
This calculator runs entirely in your browser. It does date arithmetic on the values you enter and sends nothing to our servers.