As part of its ongoing efforts to improve online security, Google has proposed a significant change to the SSL/TLS certificate system. In a recent announcement, the tech giant revealed its plan to cut the maximum validity period of SSL/TLS certificates to just 90 days.
Currently, SSL/TLS certificates can be valid for up to two years, providing a long-term security solution for website owners and users alike. However, Google argues that shorter certificate lifetimes will increase online security by forcing website owners to update their certificates more frequently and stay up-to-date with the latest security standards.
While this proposal has been met with some resistance from website owners relying on longer certificate lifetimes for their business operations, cybersecurity experts generally agree that shorter lifetimes can be good for online security.
Reading an older article? Use the brief to stay current.
This Article Gives You the Background. The Brief Gives You What Changed Next.
Get the weekday cyber brief for new policy moves, CISA actions, and risk developments this article could not cover when it was published.
Free. Weekday mornings. 5 minutes or less.
Built from 100+ trusted cybersecurity sources.
By reducing the maximum validity period to just 90 days, website owners will need to renew their certificates more frequently, which can help to prevent potential security breaches and keep users’ sensitive data safe. Additionally, shorter certificate lifetimes can help to mitigate the impact of any compromised certificates, as they will expire sooner and be less useful to attackers.
However, this proposal does come with some potential drawbacks, including increased administrative costs for website owners and the potential for more certificate-related issues and errors.
While Google’s proposal may shock some, it’s clear that the tech giant is committed to improving online security for everyone. As this proposal continues to develop, it’s important for website owners and users alike to stay informed about the potential impacts on their online security and take steps to protect themselves accordingly.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
MikroTrick: MikroTik RouterOS Flaws Are Hijacking Internet-Exposed Routers
What Changed Poland's CERT.PL is warning that attackers are actively exploiting a chain of MikroTik RouterOS vulnerabilities it calls MikroTrick. The chain...
N-able N-central CVE-2026-86218: Pre-Auth RCE Puts MSP Customers in the Blast Radius
What Changed N-able released an emergency fix for CVE-2026-86218, a critical vulnerability in N-central that can allow pre-authenticated remote code execution on...
StyleSmuggler: Magento and Adobe Commerce CVSS 10.0 RCE Is Under Active Attack
What Changed Sansec has disclosed an unauthenticated remote-code-execution chain in Magento and Adobe Commerce that it calls StyleSmuggler. Adobe tracks the issue...
The 5-Minute Cyber Brief: September 8, 2026
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
