Ready for 47-day publicly trusted TLS certificates?
The 200-day maximum currently applies to newly issued publicly trusted TLS certificates. Model your projected renewal workload, operational exposure and automation readiness before the next reduction.
Next reduction: 100 days on 15 March 2027
The maximum validity for publicly trusted TLS subscriber certificates issued on or after each date is 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029.
Readiness assessment
Assessment responses remain in this browser and are not submitted.
Private certificates are not governed by the CA/Browser Forum public TLS validity schedule.
Cost assumptions Optional inputs for labour and outage-impact estimates
Each country default is the national average employee wage (latest official labour statistics, 2024 to 2025) grossed up by 1.3 for fully loaded overhead, then scaled by the selected industry using published by-sector pay ratios (finance and technology pay the most, education and manufacturing near the average). Treat it as a conservative starting point. Sector pay varies within each industry, so replace it with a figure approved by your finance or operations team.
Use the fully loaded annual cost for an engineer involved in certificate operations.
Estimate the revenue exposed during one hour of customer-facing service interruption.
Your readiness
Public TLS estimates assume renewal at the maximum permitted validity. Actual totals may be higher (early renewal) or lower (retirements, consolidation, or a certificate that renews only once in a year).
Methodology and limitations
Readiness is a preparedness index: it reflects process and ownership maturity, adjusted for estate scale, topology and incident history. Operational risk is calculated independently as a weighted blend of five factors: process maturity, ownership clarity, incident history, environment complexity and projected 47-day renewal workload. It is a comparative planning index, not an outage probability. Outage impact models one 3-hour interruption plus 40 engineer-hours of remediation; it is not an expected annual loss. For this model, one FTE is assumed to equal 1,760 productive engineering hours. Cost assumptions are illustrative and should be replaced with organisation-approved figures. This tool is an indicative planning aid, not a compliance assessment, quotation or financial forecast.
The validity countdown
Maximum validity of publicly trusted TLS subscriber certificates under requirements introduced through CA/Browser Forum Ballot SC-081v3.
15 Mar 2026
15 Mar 2027
15 Mar 2029
Domain and IP address validation reuse changes on the same milestone dates: 200 days from 15 March 2026, 100 days from 2027 and 10 days from 2029.
Indicative planning estimate, not a compliance assessment. Requirements source: CA/Browser Forum TLS Baseline Requirements.
