Short introduction · 1.1
Why automation matters
Public TLS certificates are valid for an ever shorter time, and the CAs have to check domain control more often. A renewal by hand once a year does not fit these validity periods. With a validity of 47 days, a certificate is renewed 8 to 12 times a year. TLSPilot therefore automates the whole process, from the order to the deployment and the Health check.
| From | Rule | What it means for you |
|---|---|---|
| CA/Browser Forum, Ballot SC-081: maximum validity and reuse of the domain validation | ||
| 15.03.2026 | At most 200 days validity; a domain validation may be reused for 200 days. | At least two renewals per year. |
| 15.03.2027 | At most 100 days; reuse of the domain validation 100 days. | About four renewals per year. |
| 15.03.2029 | At most 47 days; reuse of the domain validation only 10 days. | Practically every renewal needs a new validation, so DNS API access or port 80 must work permanently. |
| Chrome Root Program | ||
| 15.03.2027 | Every CA in the Chrome root store must offer an automation solution for all its kinds of TLS certificates. If it uses ACME, it must support ARI and the CAA extensions of RFC 8657 (accounturi, validationmethods), see chapter CAA records. | ARI becomes standard at public CAs, see chapter ARI – ACME Renewal Information. |
| Let’s Encrypt | ||
| 04.06.2025 | No expiry emails. | Monitoring is your task. Use the alerts of TLSPilot, see chapter Keep it renewing. |
| 06.08.2025 | No OCSP: certificates contain no OCSP URL. Revocation information only via CRL. | Clients and checks must work without OCSP. |
| 11.02.2026 | Profile classic without the TLS client authentication EKU (clientAuth). | If you also use public certificates for client authentication, for example server to server or in some VPN or SQL scenarios, you need an alternative such as an internal PKI or the Enterprise CA (AD CS). |
| 10.02.2027 | classic: 64 days validity; 45 days from 16.02.2028. | TLSPilot takes the maximum of the renewal window from the actual certificate, see chapter When the renewal runs. |