Field Notes: Your Public Certificates Are About to Expire 5x Faster (Video)

New series: Field Notes — challenges I actually hit in the field, distilled to 90 seconds. First up: the quiet deadline hanging over every public TLS certificate you own.

The note, in writing

1. The deadline is real and staged. The CA/Browser Forum’s ballot SC-081v3 caps public TLS certificate validity at 200 days since March 2026, 100 days from March 2027, and 47 days from March 2029. Manual renewal doesn’t survive that math — automation stops being a nice-to-have.

2. The easy 90%. ACM auto-renews certificates attached to AWS entry points (CloudFront, ALB/NLB, API Gateway). DNS-validate once through your IaC and rotation becomes nobody’s job. If your fleet terminates on AWS, most of the problem dissolves here.

3. Trap one — vendor CA allowlists. Some SaaS integrations only accept certificates from specific certificate authorities, and Amazon Trust Services isn’t always on the list. Check your vendors’ documented CA requirements before the migration wave, and track the exceptions explicitly (with an owner and a renewal process) instead of discovering them as integration outages.

4. Trap two — endpoints that terminate off AWS. ACM private keys historically never left AWS. For TLS that terminates elsewhere, exportable public certificates now close that gap (at a per-certificate cost) — or re-front the endpoint with an AWS entry point and let ACM do its job.

5. The pattern. Inventory everything → automate the easy 90% on ACM → isolate the exceptions with owners and dates. A certificate you can’t auto-renew today is an outage scheduled for 2027.

Staring at a certificate spreadsheet right now? Start with the inventory. More notes from the field every week — and the video also runs on LinkedIn.