Skip to main content
Question

Impact of CA/B Forum SC-081v3 TLS Certificate Validity Reduction – IFS Product Roadmap and Recommendations

  • June 16, 2026
  • 1 reply
  • 89 views
H
Sidekick (Partner)
Forum|alt.badge.img+7

We recently reviewed the approved CA/B Forum Ballot SC-081v3, which introduces a phased reduction of publicly trusted TLS certificate validity periods and validation data reuse periods over the coming years.

As currently published, the maximum TLS certificate validity period will gradually reduce from 398 days to 47 days by March 2029, while domain validation reuse periods will eventually reduce to as little as 10 days.

Given these industry-wide changes, we would like to understand IFS's plans and recommendations regarding certificate lifecycle management for IFS Cloud environments.

Could you please provide information on the following for remote deployment:

1. Has IFS already assessed the impact of SC-081v3 on IFS Cloud deployments and related components?
2. Are there any planned product enhancements or roadmap items to support shorter certificate lifecycles?
3. Does IFS have any recommendations for automated certificate management solutions or approaches that can be used within IFS Cloud environments, particularly for remote customers, to simplify certificate issuance, renewal, and deployment?
4. Does IFS plan to publish any guidance, best practices, or technical documentation related to these upcoming changes?

 

Additionally, I would like to understand what happens when mtinstaller is executed. Could you please clarify which pod(s) or container(s) are updated with the SSL certificate, and where the certificate is stored within the environment, including the relevant path inside the pod or container?

As certificate validity periods move towards 47 days, manual certificate management will become increasingly challenging, and we would like to ensure our long-term strategy aligns with IFS recommendations.

We would appreciate any information regarding IFS's assessment, roadmap, and recommended preparations for customers.

Reference: https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/

Best Regards, HashanD www.linkedin.com/in/hashan-dias-pannilaratne

1 reply

IFS Community
Sidekick (Employee)
Forum|alt.badge.img+9
  • IFS Community
  • Sidekick (Employee)
  • July 15, 2026

Hi ​@HashanD 

Thank you for raising this important topic.

The CA/B Forum SC-081v3 changes are recognised across the industry and will significantly reduce the validity period of publicly trusted TLS certificates over the coming years. IFS is actively assessing and addressing the impact this will have on certificate lifecycle management across IFS Cloud deployment models, including Remote deployments. 

Has IFS assessed the impact of SC-081v3?

Yes. We have reviewed the impact of the phased reduction in certificate validity periods (200 days from March 2026, 100 days from March 2027, and 47 days from March 2029). Our assessment is that increasingly frequent manual renewal processes will become operationally challenging and that greater automation will be required to maintain security, reliability and operational simplicity.

Are there planned product enhancements or roadmap items?

IFS has ongoing engineering work and roadmap planning focused on improving certificate lifecycle management and reducing the operational impact of certificate renewals. This includes investigation of more automated approaches to certificate deployment, as well as mechanisms to minimise or eliminate service disruption during certificate updates. 

As with all roadmap-related topics, future delivery timelines and scope remain subject to planning and prioritisation.

What certificate management approaches are recommended today?

For Remote deployments, IFS recommends that customers align certificate management with their organisation's established PKI and security standards. Where possible, customers should consider adopting automated certificate lifecycle management solutions capable of:

  • Automated certificate issuance and renewal.
  • Automated deployment to ingress, load balancers and other TLS endpoints.
  • Certificate expiry monitoring and alerting.
  • Auditability and reporting of certificate lifecycle events.
  • Integration with centralised certificate management platforms.
  • Many certificate vendors provide automated certificate renewal features via the ACME protocol and through a subscription type plan.

The most appropriate implementation will vary depending on the customer's infrastructure platform, security requirements and operational model. 

Will IFS publish guidance, best practices or technical documentation?

As our work in this area progresses, we expect to provide additional guidance and best practices to help customers adapt to shorter certificate lifecycles. Our objective is to ensure customers can continue to operate IFS Cloud securely and efficiently as industry certificate requirements evolve.

 

The current IFS Technical Documentation provides the following information about certificate handling: https://docs.ifs.com/techdocs/26r1/070_remote_deploy/010_installing_fresh_system/010_planning_installation/020_security_considerations/010_certificates/?h=certificate

Technical question: When mtinstaller is executed, which pods/containers are updated and where is the certificate stored?

For Remote deployments, the certificate supplied through the certificateFile installation parameter is imported as part of the IFS Cloud deployment process and stored as a Kubernetes TLS secret.  This is documented here: https://docs.ifs.com/techdocs/26r1/070_remote_deploy/010_installing_fresh_system/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/?h=#general_parameters.  The certificate is not managed as a standalone file within individual application containers. Instead, the relevant containers retrieve and use the certificate from Kubernetes-managed secrets at runtime - so the location of the cert within each pod in this case does not matter as each container which needs the cert will retrieve this as needed at runtime.

From an operational perspective, customers should consider the Kubernetes TLS secret as the primary certificate management location within the IFS Cloud platform. While the specific pods consuming the certificate may vary depending on deployment topology and ingress configuration, certificate management is performed through Kubernetes resources rather than by manually updating certificate files within individual containers, and the certificate is updated via the Helm chart through the IFS Installer.

In the context of SC-081v3, this architecture provides a foundation for future improvements in certificate lifecycle automation, as certificate renewal processes can be focused on updating the centrally managed Kubernetes TLS secret rather than requiring manual certificate updates within each individual application container. This aligns with industry direction towards automated certificate management and shorter certificate lifecycles. 


CC: ​@imurphy 

For support please contact community@ifs.com
Terms & ConditionsAccessibility statement