It was recently announced that Google Chrome will be joining Apple Safari in implementing a change to publicly trusted SSL/TLS certificates. This change, however, will impact organizations operating their own internal PKI as well.

While the change was initially submitted to the official CA/Browser Forum, the vote failed last year. However, both Apple and Google have unilaterally announced that as of September 1, 2020, their browsers will only trust SSL/TLS certificates valid for 398 days or less (consider this 1 year, with a 10% fudge factor).

Since Google and Apple represent the large majority of browsers in use (over 80%), their adoption of this change makes it a near industry standard regardless of the CA/B Forum and other browser behaviors.

This is similar to the impact on internal PKIs we saw as the industry moved from SHA1 to SHA256 as well as the change in 2018 as the industry moved from 3-year certificates to 2-year certificate maximums.

Any existing SSL/TLS certificates you have will remain valid as long as they were issued PRIOR to September 1, 2020. Any certificates issued on that date or later, must have a validity period no longer than 398 days. This will not impact certificates used for other purposes since browsers wouldn’t be involved – such as Domain Controller certificates, RDP, Client Authentication certs for WiFi/VPN, etc…

So at this point, you should be aware of the need to change your SSL/TLS certificate templates on or before September 1, 2020, to reflect this new shortened validity period.

We do recognize the impact this will have for many internal organizations as most SSL/TLS certificates are manually enrolled and renewed. This shortening from 2 years to 1 year will double that enrollment effort. If you aren’t already using or reviewing a Certificate Management solution, now might be a good time to do that. We would be happy to discuss the options with you further as well of course!


About ThePKIGuy

President & Founder at PKI Solutions, Leading PKI Cybersecurity Subject Matter Expert, Author, Speaker, Trainer, Microsoft Certified Master.


  1. Avatar Carsten Krüger on June 18, 2020 at 3:18 am

    If google handle this the same way apple handles this it not relevant for private CAs
    This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS.

    • ThePKIGuy ThePKIGuy on June 18, 2020 at 7:30 am

      Well, yes and no. For Apple and Safari, they control and know the contents of their trust store and can make this distinction. For Chrome, they don’t have their own trust store and thus don’t know if a trusted root is a public or private CA. So as a result, Chrome affects all SSL/TLS certificates in this way. So, if you are only using iOS devices with Safari you won’t be affected internally. If you use IE and Windows OS, you won’t be affected. But if you use Chrome on any OS, you will be affected. At least for now.

    • ThePKIGuy ThePKIGuy on June 18, 2020 at 8:18 am

      That is the way it is supposed to work. We found many times Chrome misidentified trusted roots and internal SHA1 PKI infrastructures – still to this day, are flagged as untrusted. Same requirement for SAN only names.

  2. Avatar Ritesh on June 18, 2020 at 9:46 pm

    Hello Team,

    Thank you for sharing the information. Can you please share the link where Google has officially announced this news, somehow I am not able to find it on the internet.


  3. ThePKIGuy ThePKIGuy on June 19, 2020 at 9:41 am

    We are still waiting on official notes from the CA/B Forum, but Dean Coclin announced the decision on Twitter:

  4. Avatar David Bluemlein on June 24, 2020 at 11:54 am

    From what I’m reading, it doesn’t sound like this will have any affect on validity periods for privately issued intermediary/root certificates. Does anyone know if if that’s the case, or if those will need to be shorted as well?

    • ThePKIGuy ThePKIGuy on June 24, 2020 at 2:41 pm

      That is the official word. What I was pointing out was that in the past we saw changes such as SHA2 requirements and SAN only subject names target public CAs but found collateral impact to internal PKI issued certificates. So out of an abundance of caution, we are advising customers to be aware in case there is an unexpected impact after the September 1 date.

  5. Avatar Dean Coclin on June 25, 2020 at 10:49 am
    • ThePKIGuy ThePKIGuy on June 25, 2020 at 10:56 am

      A CA/B Forum vote through unilateral decisions! Thanks Dean.

  6. Avatar Daniel Yehezkel on July 2, 2020 at 1:36 am

    Hi mark,

    Thanks for the post.
    Also here they state “Enforce publicly trusted TLS server certificates…”

    I guess we will need to wait for the beta’s to see if there is some impacts on private CAs too.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.