The Baseline Requirements define a short-lived subscriber certificate as one valid for at most 10 days (864,000 seconds) if issued from 15 March 2024, and at most 7 days (604,800 seconds) if issued on or after 15 March 2026. Such certificates need not appear in CRLs or OCSP and may omit revocation pointers, because the exposure after a key compromise is bounded by expiry.
Let's Encrypt made its opt-in shortlived ACME profile (160 hours, a little over six days) generally available on 15 January 2026, and requires it for IP-address certificates. Private PKIs have long used hour- or day-long certificates for workloads, for example SPIFFE identities, SSH user certificates and Sigstore's Fulcio, whose code-signing certificates are valid for 10 minutes.
Short lifetimes only work with automation that renews well before expiry and handles failures; ACME Renewal Information lets the CA tell clients when to renew. Clock skew on clients matters more as lifetimes shrink.