---
schema_version: "1"
id: 3f3d6b2f287384f22cadaf2097282516d8bb7d99f085b0a90884e671c3f0486a
title: Prepare for Shorter Certificate Lifespans
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_general_certificate_lifespans.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_general_certificate_lifespans.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ecbdbf8e8a11c361869b3c0bda89a68c744aa4861d8d373c3b392a831cb9b009
description: If you use features that rely on certificates, prepare to update the related certificates more frequently. An upcoming industry-wide change decreases the maximum allowed Transport Layer Security (TLS) certificate lifespan over the next 3 years. Also, Salesforce plans to stop public certificate rotation announcements.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Prepare for Shorter Certificate Lifespans

If you use features that rely on certificates, prepare to update the related certificates more frequently. An upcoming industry-wide change decreases the maximum allowed Transport Layer Security (TLS) certificate lifespan over the next 3 years. Also, Salesforce plans to stop public certificate rotation announcements.

**Where:** This change applies to Lightning Experience, Salesforce Classic, and the Salesforce mobile app in all editions. As we reach each milestone, the lifespans apply to all new certificates that a public Certificate Authority (CA) signs, regardless of whether you, Salesforce, or a third party purchases the certificate. Existing certificates keep their expiration dates, and self-signed certificates aren't subject to the new lifespans.

**When:** In August 2025, the Certification Authority Browser Forum (CA/Browser Forum) [announced](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) a phased approach to shorten the lifespan for new TLS certificates. That lifespan decreases from 398 days to 200 days on March 15, 2026, to 100 days on March 15, 2027, and to 47 days on March 15, 2029.

As certificates rotate more frequently, Salesforce plans to stop the existing announcements for certificate changes for first-party (1P) production orgs through the [Certificate Changes Trailblazer Community group](https://trailhead.salesforce.com/trailblazer-community/groups/0F9300000001oAF). There's no specific target date for the end of those announcements. Salesforce plans to announce that date at least 90 days in advance.

**Why:** Salesforce complies with the guidance of the CA/Browser Forum, the organization that sets most Web Public Key Infrastructure (WebPKI) rules. Their TLS Server Baseline Requirements change regularly. Those requirements are outside of Salesforce control, and certificate vendors are bound by the same rules.

**How:** Review your certificate use and plan to rotate the certificates that you own more frequently and stop using certificate pinning.

To receive notifications about upcoming certificate expirations for certificates that are stored in your org, assign the Expired Certificate Notification permission to specific admins. To automate the creation and update of self-signed and Certificate Authority-signed certificates in Salesforce, use the Certificate Metadata API type.

#### See Also

- [_Salesforce Help_: Certificates in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_policy_and_rotation.htm&type=5&language=en_US)
- [_Salesforce Help_: Set Expired Certificate Notification Permission](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_set_expired_certificate_notification_permission.htm&type=5&language=en_US)
- [_Metadata API Developer Guide_: Certificate](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_certificate.htm)