Every update carries a status, an effective date, and an action.
Articles are produced from the same structured change record as the Standards Radar, so nothing here is an isolated blog post.
Weekly root signal●EffectiveEffective: Digest
Weekly root signal — week 3, 2026
Lifetime reduction preparation dominates; PQC hybrid key exchange continues to expand quietly across CDNs and browsers.
What happened
Root programs restated the 2026 schedule, hybrid X25519MLKEM768 adoption climbed in client telemetry, and Merkle Tree Certificate work continued in the IETF PLANTS working group.
Why it matters
Two clocks now run at once: shorter lifetimes and post-quantum migration. They compete for the same automation budget and the same people.
Action
Fund inventory and automation once, in a way that serves both programmes. They are the same capability.
The first 47-day step lands in March 2026: 200-day maximum lifetimes
Ballot SC-081 reduces the maximum TLS certificate lifetime to 200 days in March 2026 — the first of three reductions ending at 47 days in 2029.
What happened
The CA/Browser Forum's approved schedule takes effect: certificates issued on or after 15 March 2026 may not exceed 200 days, and domain validation reuse shortens alongside it.
Why it matters
200 days is still survivable manually, which is exactly the risk. Teams that absorb this step by working harder will hit 2027 and 2029 with no automation and far less time.
Action
Use the first reduction as the forcing function for ACME coverage, not as a scheduling exercise. Measure the share of endpoints that renewed without a human.
Shorter validation reuse is the change most teams have not modelled
Certificate lifetime gets the attention, but the collapse of domain validation reuse periods changes who has to be involved in renewal, and how often.
What happened
Alongside lifetime reduction, the reuse period for domain control validation drops in the same steps, reaching 10 days by 2029.
Why it matters
Revalidation frequently touches DNS, which is often owned by a different team than the one that owns the endpoint. Automation that only handles issuance still stalls on a human DNS change.
Action
Automate DNS-01 with delegated CNAME records now, so validation and issuance are one unattended flow.
Why your private hierarchy is the right place to pilot ML-DSA
You control every relying party in a private PKI, which removes the single biggest blocker to post-quantum signature deployment.
What happened
ML-DSA (FIPS 204) is standardized and appearing in HSM and library roadmaps, while public trust programs have not yet defined issuance profiles.
Why it matters
Larger signatures and public keys change handshake sizes, record layouts and hardware assumptions. Discovering that in production is expensive; discovering it in a private pilot is a Tuesday.
Action
Stand up a parallel ML-DSA issuing CA for one non-critical internal service population and measure handshake size, latency and hardware support.
The outage was not expiry — it was a chain the client could not build
A recurring failure shape: the server certificate is valid, but an intermediate is missing or a cross-signed path is no longer accepted by older clients.
What happened
Servers configured with an incomplete chain work in browsers that cache or fetch intermediates, and fail in embedded clients, older Java stacks and mobile SDKs that do not.
Why it matters
Monitoring that only checks expiry dates reports green throughout. The failure is invisible until a specific client population breaks.
Action
Validate the served chain from multiple client trust stores after every deployment, not just the leaf's validity window.