Businesses Brace for Reduced SSL/TLS Certificate Validity Amid Regulatory Changes
Swedish businesses face significant operational challenges as SSL/TLS certificate validity periods are set to shorten dramatically by 2029.
- • SSL/TLS certificate validity will reduce from 398 days to 47 days by 2029
- • Automation of certificate management is critical to avoid disruptions
- • High-risk sectors include e-commerce, finance, and public services
- • Dotkeeper offers automated solutions to help businesses comply.
Key details
Starting in 2026, public SSL/TLS certificate validity periods will be significantly reduced, culminating in just 47 days by 2029. This decision, made by the CA/Browser Forum, aims to enhance security but poses considerable operational challenges for businesses, particularly in Sweden's critical sectors such as finance, e-commerce, and public services. Currently, SSL/TLS certificates are valid for up to 398 days, but the phased reduction will see strict limits of 200 days in 2026 and 100 days in 2027 before reaching just 47 days in 2029.
Fredrik Nilsson, a domain security expert and Head of Client Team at Dotkeeper, warns that the transition will necessitate a shift to automated certificate management systems. Companies relying on manual renewal processes could face severe operational risks as the frequency of required renewals will increase dramatically. Nilsson notes, "Manual processes for certificate renewal are not sustainable in the new system," urging organizations to map their existing public certificates and identify where manual interventions occur.
As the deadline approaches, firms are advised to implement automated solutions to mitigate the risk of service disruptions. Without timely renewals, expired certificates could lead to the failure of critical online services, including websites and applications, impacting customer trust and revenue.
Sectors that manage large amounts of sensitive user data are particularly vulnerable. Businesses in e-commerce, finance, and government services must prioritize the automation of their certificate lifecycle – from procurement to renewal and monitoring. Companies like Dotkeeper are already collaborating with partners like Sectigo to offer robust automated certificate management solutions aimed at maintaining compliance and securing digital assets.
Nilsson emphasizes the importance of strategic planning in moving towards automation, stating, "Companies should act strategically and long-term in managing their digital assets before the changes become urgent," highlighting the pressing timeline for businesses to adapt before regulatory changes come into full effect.