WebPKI Observatory — BR Readiness
Of 35 active TLS-issuing CAs measured, only 8 already issue certificates meeting the 47-day validity threshold planned for March 2029, while 5 remain at risk of noncompliance with the 100-day limit coming in March 2027. The median CA currently issues 62-day certificates, above the intermediate March 2027 threshold but requiring operational changes before the final step. Readiness is complicated by the regulatory surface CAs must navigate, which has grown 121x since 2000 to 6,657 total requirements, of which 76% are mandatory, distributed across CA/B Forum baseline requirements, four root program policies, WebTrust and ETSI audit criteria, and IETF/ISO/NIST standards.