If you use features that rely on certificates, prepare to update the related certificates more frequently. An upcoming industry-wide change decreases the maximum allowed Transport Layer Security (TLS) certificate lifespan over the next 3 years. Also, Salesforce plans to stop public certificate rotation announcements.
Where: This change applies to Lightning Experience, Salesforce Classic, and the Salesforce mobile app in all editions. As we reach each milestone, the lifespans apply to all new certificates that a public Certificate Authority (CA) signs, regardless of whether you, Salesforce, or a third party purchases the certificate. Existing certificates keep their expiration dates, and self-signed certificates aren't subject to the new lifespans.
When: In August 2025, the Certification Authority Browser Forum (CA/Browser Forum) announced a phased approach to shorten the lifespan for new TLS certificates. That lifespan decreases from 398 days to 200 days on March 15, 2026, to 100 days on March 15, 2027, and to 47 days on March 15, 2029.
As certificates rotate more frequently, Salesforce plans to stop the existing announcements for certificate changes for first-party (1P) production orgs through the Certificate Changes Trailblazer Community group. There's no specific target date for the end of those announcements. Salesforce plans to announce that date at least 90 days in advance.
Why: Salesforce complies with the guidance of the CA/Browser Forum, the organization that sets most Web Public Key Infrastructure (WebPKI) rules. Their TLS Server Baseline Requirements change regularly. Those requirements are outside of Salesforce control, and certificate vendors are bound by the same rules.
How: Review your certificate use and plan to rotate the certificates that you own more frequently and stop using certificate pinning.
To receive notifications about upcoming certificate expirations for certificates that are stored in your org, assign the Expired Certificate Notification permission to specific admins. To automate the creation and update of self-signed and Certificate Authority-signed certificates in Salesforce, use the Certificate Metadata API type.