The Evolution of TLS Certificate Validity: 5 Years to 90 Days
In the early days of Public Key Infrastructure (PKI), commercial Certificate Authorities (CAs) issued SSL certificates with validity periods of 3, 5, or even 8 years. While convenient for system administrators, long-lived certificates represent a catastrophic security failure mode: if an attacker compromises a server's private key via a Heartbleed-style vulnerability or physical server theft, that key can be used to impersonate the organization and decrypt customer sessions for years.
Over the past decade, the CA/Browser Forum (CABF) has steadily compressed the maximum allowable validity for public trust:
- 2015: Reduced from 5 years to 39 months (3 years).
- 2018: Reduced to 825 days (2 years).
- September 2020: Enforced by Apple, Google, and Mozilla at 398 days (1 year + grace period).
- Google Chrome Root Program Policy Proposal (2023–2026): Mandates reducing maximum validity to 90 days (and subsequently 45 days).
The Flaw of Revocation: Why OCSP and CRLs Failed
Why can't we simply keep 1-year certificates and revoke compromised ones? Because internet-scale certificate revocation is fundamentally broken:
The Revocation Trilemma
1. Certificate Revocation Lists (CRLs): Serial number blacklists published by CAs. For large CAs, CRL files balloon to tens of megabytes, imposing unacceptable mobile latency and battery drain.
2. Online Certificate Status Protocol (OCSP): Real-time HTTP queries to the CA during TLS handshakes. Adds 50ms to 200ms latency to every connection, leaks user browsing history to CAs, and suffers from "soft-fail" semantics—browsers ignore OCSP errors when CAs go offline, rendering it ineffective against active attackers.
3. OCSP Stapling: The server fetches and caches its own signed OCSP response. Better, but complex to configure and unsupported on many legacy load balancers.
By reducing certificate validity to 90 days, the certificate revokes itself naturally through expiration, eliminating reliance on brittle external revocation infrastructure.
The Mathematics of Manual Management in a 90-Day World
While large enterprises could tolerate manual ticketing workflows when renewals occurred once every year, a 90-day lifespan completely destroys manual operations.
Binomial Outage Probability Formula
$$N_{text{renewals}} = text{Fleet Size} times left( frac{365}{text{Validity Days} times text{Renewal Threshold}} right)$$
If each manual renewal event carries a failure probability $p_{text{fail}}$ (e.g., $2.5%$ chance of human delay, DNS misconfiguration, or forgotten host):
$$P(text{Outage in Year}) = 1 - (1 - p_{text{fail}})^{N_{text{renewals}}}$$
For an enterprise managing 50 certificates under a 90-day policy (renewing every 60 days):
$$N_{text{renewals}} = 50 times frac{365}{60} approx mathbf{304text{ renewal events/year}}$$
$$P(text{Outage}) = 1 - (1 - 0.025)^{304} = 1 - (0.975)^{304} = 1 - 0.00047 = mathbf{99.95%}$$
A 99.95% annual outage probability means catastrophic browser security warnings (NET::ERR_CERT_DATE_INVALID), blocked customer checkout carts, and SEO search ranking demotions are a mathematical certainty under manual management!
ACME Protocol Automation & Best Practices
To survive and thrive in the 90-day regime, organizations must fully automate certificate lifecycles using the ACME (RFC 8555) protocol:
- Trigger Renewal at Day 60: Always configure ACME clients (Certbot, Caddy, Traefik, or HashiCorp Vault) to attempt renewal when 30 days remain (66% elapsed). If renewal fails, automated alerts fire with 30 days of runway remaining to fix the underlying issue.
- Automate Web Server Reloads: Ensure your ACME renewal hooks execute graceful daemon reloads (
systemctl reload nginx) rather than restarts, avoiding active connection drops. - Prefer DNS-01 Challenges for Wildcards and Private Clusters: While HTTP-01 challenges require port 80 to be open to the public internet, DNS-01 challenges validate domain ownership via API TXT record insertion, enabling automated issuance for internal VPNs, databases, and private Kubernetes clusters.