Vendors vote to radically slash website certificate duration

“This is fully what we were expecting,” said Jon Nelson, a principal advisory director at Info-Tech Research Group. “[But] I do question the motives of the group. They are doing this under the auspices of reducing risk, but I question if that is the real reason. Do the people making up this group have a conflict of interest in that this move could generate additional revenue for their companies?”

Although the group voted overwhelmingly to approve the change, with zero “No” votes, not every member agreed with the decision; five members abstained.

Tim Callan, the chief compliance officer at Sectigo and vice chair of the CA/Browser Forum, said that one of the certificate authority (CA) members who abstained, who he declined to identify, wrote a note to the group. Callan said it read, “we have mixed feelings about this. We are in favor in principle. However, we are unconvinced that the most restrictive terms are necessary, to go all of the way down to 47 days.”