CA/Browser Forum Ballot SC-063 v4 allows for short-life certificates that do not require CRL or OCSP support.
Key Highlights:
- Short-Lived Certificates (≤10 days):
CAs are now permitted to issue TLS certificates with validity periods of 10 days or fewer, classifying them as short-lived.
- 7-Day Limit Coming:
As outlined in CAB Forum Ballot SC-063v4, the allowable validity period for short-lived certificates will be capped at 7 days starting March 15, 2026.
- No Revocation Required:
Because short-lived certificates expire quickly—often before the next scheduled CRL or OCSP update—CAs are not obligated to publish revocation information or include CRL/OCSP URLs in the certificate. This aligns with the understanding that traditional revocation mechanisms are not effective for such short durations.
Â
Let’s Encrypt Issues First 6-Day Certificates
According to the Let’s Encrypt blog post dated February 20, 2025, the organization issued its first six-day certificate on February 19, 2025. Leveraging the ACME Renewal Information (ARI) extension, Let’s Encrypt can streamline renewals and handle revocations more efficiently.
Looking Ahead
The Ballot aims to encourage automation (e.g., ACME ARI) to support the use of short-life certificates, especially in environments that can handle rapid certificate rotation.TuringSign continues to support both Certificate Revocation Lists (CRL) and Online Certificate Status Protocol (OCSP) for all SSL/TLS certificates, in compliance with the requirements of major Browser and Root Store Trusted Root Programs.Â
Â
