GMO GlobalSign is warning organizations to prepare for two certificate lifecycle reductions taking effect in March 2026, following decisions adopted through the CA/Browser Forum. The changes affect both code signing certificates and TLS/SSL certificates, with implementation dates separated by roughly two weeks.
Beginning March 1, 2026, the maximum validity period for publicly trusted code signing certificates will be reduced from 39 months to 460 days. The change stems from CA/Browser Forum Ballot CSC-31, which was approved with support from certificate issuers and formalized after completing the forum’s intellectual property rights review process.
A second shift follows on March 15, 2026, when newly issued TLS/SSL subscriber certificates will be capped at a maximum validity of 200 days under the CA/Browser Forum’s Baseline Requirements. This reduction marks the first step in a longer schedule that tightens certificate lifecycles further in subsequent years.
GlobalSign says the proximity of the two deadlines creates a concentrated operational challenge for organizations that issue, manage, or renew certificates at scale. The company reports that it stopped issuing two-year and three-year code signing certificates on December 26, 2025, and now issues one-year code signing certificates with a maximum validity of 366 days. Existing certificates issued under previous rules remain valid until their expiration, but renewals after late February 2026 must comply with the new limits.
Shorter certificate lifecycles are intended to reduce exposure if keys are compromised or cryptographic standards evolve, while improving revocation responsiveness and overall security hygiene. At the same time, the changes increase the frequency of renewals and place greater emphasis on automation across certificate management workflows.
While the developments are not specific to biometrics, they directly affect the identity security infrastructure underpinning digital identity systems. Code signing plays a central role in software authenticity and supply-chain trust, while TLS secures communications for identity services, including digital ID issuance platforms, verification services, and wallet back-end systems.
For operators of identity platforms and large software estates, March 2026 will be a forcing point to modernize certificate lifecycle management. With code signing and TLS reductions arriving within weeks of each other, organizations face a compressed timeline to ensure renewal processes, tooling, and governance models are aligned with the new requirements.
Sources: GlobalSign, CA/Browser Forum, CA/Browser Forum, CA/Browser Forum
—
By Ali Nassar-Smith
