--- title: Get Ready for Seven-Day Certificates | daily.dev description: Browser vendors are moving Web PKI toward Merkle Tree Certificates (MTCs) to support post-quantum authentication, unifying X.509 certificates with Certificate... canonical: https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Get Ready for Seven-Day Certificates | daily.dev og:description: Browser vendors are moving Web PKI toward Merkle Tree Certificates (MTCs) to support post-quantum authentication, unifying X.509 certificates with Certificate... og:url: https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql og:image: https://api.daily.dev/og/posts/W0h4XywqL.png og:image:alt: Get Ready for Seven-Day Certificates og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get Ready for Seven-Day Certificates **[Feisty Duck](https://daily.dev/sources/feistyduck)** · 4 min read · 0 upvotes · 0 comments ## Summary Browser vendors are moving Web PKI toward Merkle Tree Certificates (MTCs) to support post-quantum authentication, unifying X.509 certificates with Certificate Transparency. Chrome's Quantum-resistant Root Program Policy caps subscriber certificates at 47 days, with a main CA cosigner limited to 7-day certificates; Apple has already confirmed a hard 7-day cap in its own post-quantum plans. ACME and ACME Renewal Information (RFC 9773) will handle automated issuance and rotation, since sites may need to juggle up to four certificate types (RSA, ECDSA, and MTC's 'slow' and 'fast' variants) simultaneously. Shorter lifetimes improve revocation but shrink the margin for error to fix problems before expiry, making rock-solid automation and continuous monitoring essential. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the maximum certificate lifetime under Chrome's Quantum-resistant Root Program Policy for Merkle Tree Certificates? Chrome's policy caps subscriber certificates at 47 days when issued through optional cosigners, but the main CA cosigner (equivalent to today's root certificate) is limited to issuing certificates valid for only 7 days. Apple has confirmed the same 7-day hard cap in its own advance post-quantum plans, published in Chrome's CT policy group. _Teams planning certificate automation for shorter lifetimes can track PKI changes like this on daily.dev._ ### What are Merkle Tree Certificates (MTCs) and how do they relate to Certificate Transparency? Merkle Tree Certificates are a new Web PKI technology being developed at the IETF Plants Working Group that unifies traditional X.509 certificates with Certificate Transparency. MTC introduces two certificate types: a 'slow' certificate available immediately at issuance, and a 'fast' certificate that becomes available a couple of hours later. Google's deployment plan targets MTC certificates in production by the end of 2027. _Anyone tracking the post-quantum TLS migration can follow MTC developments on daily.dev._ ### Why will all TLS certificates be limited to a 47-day lifetime starting in March 2029? All certificates will be capped at 47 days from March 2029 as part of the post-quantum Web PKI transition, forcing reliance on ACME automation since manual monthly rotation is impractical. Sites may need up to four certificate types simultaneously (RSA, ECDSA, plus MTC's slow and fast variants), with ACME Renewal Information (RFC 9773) used to enforce early rotation. _Developers preparing certificate automation for the 2029 deadline can follow this transition on daily.dev._ ## Similar posts on daily.dev - [Web PKI Reimagined with Merkle Tree Certificates](https://daily.dev/posts/web-pki-reimagined-with-merkle-tree-certificates-ancuapixf) · Feisty Duck · 0 upvotes · 0 comments - [From 398 Days to 47: Why Website Security Certificates Are Getting Shorter?](https://daily.dev/posts/from-398-days-to-47-why-website-security-certificates-are-getting-shorter--romldzze9) · Latest Hacking News · 0 upvotes · 0 comments - [How CISOs can prepare for the new era of short-lived TLS certificates](https://daily.dev/posts/how-cisos-can-prepare-for-the-new-era-of-short-lived-tls-certificates-vpcjrpss7) · CSO Online · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#pki](https://daily.dev/tags/pki) [View this post on daily.dev](https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Get Ready for Seven-Day Certificates","url":"https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql"},"datePublished":"2026-09-30T10:26:29.486Z","dateModified":"2026-09-30T10:26:52.944Z","description":"Browser vendors are moving Web PKI toward Merkle Tree Certificates (MTCs) to support post-quantum authentication, unifying X.509 certificates with Certificate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c9c83a53ed6f391622326e45c7cfc2a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c9c83a53ed6f391622326e45c7cfc2a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Feisty Duck","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Feisty Duck","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/59577cbb7af9485c86e436fa6bacece0","url":"https://daily.dev/sources/feistyduck"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,pki","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Feisty Duck","item":"https://daily.dev/sources/feistyduck"},{"@type":"ListItem","position":3,"name":"Get Ready for Seven-Day Certificates"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/get-ready-for-seven-day-certificates-w0h4xywql#faq","mainEntity":[{"@type":"Question","name":"What is the maximum certificate lifetime under Chrome's Quantum-resistant Root Program Policy for Merkle Tree Certificates?","acceptedAnswer":{"@type":"Answer","text":"Chrome's policy caps subscriber certificates at 47 days when issued through optional cosigners, but the main CA cosigner (equivalent to today's root certificate) is limited to issuing certificates valid for only 7 days. Apple has confirmed the same 7-day hard cap in its own advance post-quantum plans, published in Chrome's CT policy group. Teams planning certificate automation for shorter lifetimes can track PKI changes like this on daily.dev."}},{"@type":"Question","name":"What are Merkle Tree Certificates (MTCs) and how do they relate to Certificate Transparency?","acceptedAnswer":{"@type":"Answer","text":"Merkle Tree Certificates are a new Web PKI technology being developed at the IETF Plants Working Group that unifies traditional X.509 certificates with Certificate Transparency. MTC introduces two certificate types: a 'slow' certificate available immediately at issuance, and a 'fast' certificate that becomes available a couple of hours later. Google's deployment plan targets MTC certificates in production by the end of 2027. Anyone tracking the post-quantum TLS migration can follow MTC developments on daily.dev."}},{"@type":"Question","name":"Why will all TLS certificates be limited to a 47-day lifetime starting in March 2029?","acceptedAnswer":{"@type":"Answer","text":"All certificates will be capped at 47 days from March 2029 as part of the post-quantum Web PKI transition, forcing reliance on ACME automation since manual monthly rotation is impractical. Sites may need up to four certificate types simultaneously (RSA, ECDSA, plus MTC's slow and fast variants), with ACME Renewal Information (RFC 9773) used to enforce early rotation. Developers preparing certificate automation for the 2029 deadline can follow this transition on daily.dev."}}]} ```