47-Day Certificates Are Coming: Five Things to Do Before They Arrive

Home>Blog>47-Day Certificates Are Coming: Five Things to Do Before They Arrive

MichaelWright

,NatalieTzukrel

Oct 5, 20264 min read

Somewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature.DigiCert’s 2026 research with Omdiasurveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of what they hold. The spreadsheet works because renewals come around once a year, and one person with a calendar can keep the whole estate in their head.

The industry has decided to take that away.The CA/Browser Forum votedin April 2025 to bring the maximum TLS certificate lifespan down in steps:200 days from March 2026, 100 days from March 2027, and 47 days from March 2029, with domain validation reuse dropping to 10 days. The first step is already live: since March 15, 2026, no publicly trusted TLS certificate can be valid for more than 200 days. By 2029 you will be proving ownership of your domains roughly every month, for every certificate, forever. The spreadsheet does not survive that. Neither does the person.

Shorter lifespans shrink the window in which a stolen key or a mis-issued certificate is useful, and they push the whole ecosystem onto automation, which is where the reliability actually comes from. The destination is better. The journey is where outages live. Every manual step in your renewal process is a place where a 47-day cycle breaks something a 365-day cycle never stressed. We coveredwhat the vote means for Imperva customerswhen it passed; this post is the checklist.

Imperva-managed certificates have already moved to 90-day validity (with domain validation every 99 days), ahead of the industry deadlines, with renewal and deployment automated end to end. Root trust is moving too:the GlobalSign root transition (R3 to R46)is covered by a cross certificate that Imperva includes by default until the R3 root expires in March 2029, so legacy clients keep working, andaction is needed only if you pin to a specific root certificate. The direction of travel is simple. Certificate work becomes something you configure once, not something you do monthly.

The detail lives in theCloud WAF documentation, and walks the site-certificate path step by step.

Back to that spreadsheet. If it is yours, the right time to retire it is while it still works. If you retired it years ago, the question is whether your automation reaches all the way to your applications, or stops at the CA.

When do 47-day TLS certificates take effect?From March 15, 2029, publicly trusted TLS certificates can be valid for no more than 47 days. The CA/Browser Forum schedule gets there in steps: 200 days from March 15, 2026 (already in force) and 100 days from March 15, 2027.

How often will I need to validate domain ownership?The period for reusing domain validation follows the same schedule: 200 days from March 2026, 100 days from March 2027 and 10 days from March 2029. In practice that means validating for almost every renewal, which is why an automated method such as CNAME delegation matters.

Do I need to do anything for Imperva-managed certificates?Imperva renews and deploys its managed certificates automatically, and they already have 90-day validity. What stays with you is domain validation (automatic CNAME validation removes it), moving SNI sites from shared account certificates to site certificates, and updating your trust store if you pin to a root certificate.

What happens to clients that don’t support SNI?A client that doesn’t send SNI can’t be served a site certificate, and once a site moves to SNI-only mode those connections are rejected. A custom rule with the filterhasSNI == false, set to Alert, shows whether you have any before you switch.

Protect your business for 30 days on Imperva.

Protect your business for 30 days on Imperva.

GayleBaird

Oct 8, 20265 min read

MichaelWright

,RoyAmir

Oct 5, 20264 min read

MichaelWright

Sep 23, 20267 min read

MichaelWright

,ZivRika

Aug 24, 20264 min read

MichaelWright

Aug 15, 20264 min read

RohitKumar

,AmritTalapatra

Aug 13, 20261 min read

Cookie PreferencesTrust CenterModern Slavery StatementPrivacyLegal

Cookie PreferencesTrust CenterModern Slavery StatementPrivacyLegal

Copyright © 2026 Imperva. All rights reserved