CA/Browser Forum

Right.

But the interesting thing here is that if we build the tools to integrate with the ecosystem so that the system that I'm using knows the current set of rules of the CAB Forum, knows the set of rule of, say, X9, the way they have decided to go and proceed, these tools might actually be very, um, at much higher integration levels and provide the end users, even if they don't have the full 30 years of expertise, the ability to build really well-thought-out systems.

And we might be able to inject crypto agility, which signature should you get, what cryptographic algorithm, what key sizes, m- when to deprecate this and that.

'Cause we will eventually probably have to automate a whole...

Historically, you could buy a certificate, and it would be valid for three, sometimes five years.

But the CA Browser Forum, which is the governing body that dictates these industry standards, has been steadily forcing that timeline down.

The numbers in the report are wild.

As of March twenty twenty-six, the maximum allowed validity for a public TLS certificate drops to just two hundred days.