The validity period of publicly trusted TLS certificates will be gradually reduced over the coming years. For administrators, this means a significantly greater workload in terms of certificate management, unless this process is automated. This article explains the background of the change, the specific timeline, and the planned approach for NoSpamProxy.
How is the validity period of publicly trusted TLS certificates changing?
In April 2025, the CA/Browser Forum decided to gradually reduce the maximum validity period of public TLS certificates from the current 398 days to 47 days. The effective dates are:
With shorter validity periods, the number of required certificate renewals increases significantly. Manual management will hardly be feasible at this frequency, which is why automation is necessary.
Shorter validity periods reduce the time window during which compromised keys can be misused. They also reduce reliance on unreliable revocation mechanisms such as CRL and OCSP. In addition, domain authorization checks (Domain Control Validation) must be renewed more frequently as a result, which prevents validation data from becoming outdated.
The Situation in NoSpamProxy
In NoSpamProxy, TLS certificates are primarily used to secure the SMTP connection and for communication with the web app.
Currently, NoSpamProxy does not have any automation in place for renewing and integrating TLS certificates. This will change by the final deadline in 2029, so that administrators will not incur any additional operational effort in running NoSpamProxy as a result of the transition.
Our timeline is based on the guidelines of the CA/Browser Forum and consists of two steps:
1. Interim Solution Through March 15, 2027
By the deadline for the 100-day rule, an interim solution will be available that allows customers to automatically renew TLS certificates and integrate them directly into NoSpamProxy. This solution will address the immediate need arising from the shorter validity periods starting in 2026 and 2027.
2. Native ACME support by 2029
In the long term, the interim solution will be replaced by native integration of the ACME (Automatic Certificate Management Environment) protocol into NoSpamProxy. ACME is the de facto standard for the automated issuance and renewal of TLS certificates and is already supported by numerous certificate authorities. Native integration will ensure stability and simplicity during operation and relieve administrators of the need for manual intervention.
Conclusion
The reduction in TLS certificate validity periods is a requirement adopted by the certification industry that has already taken effect. For operators of NoSpamProxy environments, there is no immediate need for action: With the planned interim solution through 2027 and native ACME support through 2029, automation will be available well in advance of the respective deadlines.
We will provide specific dates and details regarding implementation here as soon as further information becomes available.
