---
schema_version: "1"
id: f0574ee6756000cf2493d59f2ce4eb53129fb521ac2f8b4f658ee33611d22eef
title: Rotate Your Certificates More Frequently
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_general_certificate_lifespans.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_general_certificate_lifespans.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 03cc071c66a84839de2c8c012b4df007dd2021e7852da00127bb57ed03dd8e42
description: If you use features that rely on certificates, update the related certificates more frequently. An industry-wide change decreases the maximum allowed Transport Layer Security (TLS) certificate lifespan over the next 3 years. As of March 15, 2026, the maximum lifespan for new certificates is 200 days. Also, Salesforce plans to stop public certificate rotation announcements on July 6, 2026.
products:
  - Cross Cloud
release: "262"
---
# Rotate Your Certificates More Frequently

If you use features that rely on certificates, update the related certificates more frequently. An industry-wide change decreases the maximum allowed Transport Layer Security (TLS) certificate lifespan over the next 3 years. As of March 15, 2026, the maximum lifespan for new certificates is 200 days. Also, Salesforce plans to stop public certificate rotation announcements on July 6, 2026.

**Where:** This change applies to Lightning Experience, Salesforce Classic, and all editions of the Salesforce mobile app. As we reach each milestone, the lifespans apply to new certificates that a public Certificate Authority (CA) signs, regardless of whether you, Salesforce, or a third party purchases the certificate. Existing certificates keep their expiration dates, and self-signed certificates aren't subject to the new lifespans.

**When:** In August 2025, the Certification Authority Browser Forum (CA/Browser Forum) [announced](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) a phased approach to shorten the lifespan for new TLS certificates. That lifespan decreased from 398 days to 200 days on March 15, 2026. It decreases to 100 days on March 15, 2027 and to 47 days on March 15, 2029.

As certificates rotate more frequently, Salesforce plans to stop the existing announcements for certificate changes for first-party (1P) production orgs through the [Certificate Changes Trailblazer Community group](https://trailhead.salesforce.com/trailblazer-community/groups/0F9300000001oAF). Salesforce plans to end these announcements on July 6, 2026.

**Why:** Salesforce complies with the guidance of the CA/Browser Forum, the organization that sets most Web Public Key Infrastructure (WebPKI) rules. Their TLS Server Baseline Requirements change regularly. Those requirements are outside of Salesforce control, and certificate vendors are bound by the same rules.

**How:** Review your certificate use and plan to rotate the certificates that you own more frequently and stop using certificate pinning.

To receive notifications about upcoming certificate expirations for certificates that are stored in your org, assign the Expired Certificate Notification permission to specific admins. To automate the creation and update of self-signed and CA-signed certificates in Salesforce, use the Certificate Metadata API type.

#### See Also

- [_Salesforce Help_: Certificates in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_policy_and_rotation.htm&type=5&language=en_US)
- [_Salesforce Help_: Set Expired Certificate Notification Permission](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_set_expired_certificate_notification_permission.htm&type=5&language=en_US)
- [_Metadata API Developer Guide_: Certificate](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_certificate.htm)