FWIW, this is AI answer.
*********************************
Below is the most accurate industry-reality check I can give you right now, based on how PKI, browsers, and VPN vendors actually work, and what the 47-day change really affects.
✅ 1. The 47-day Limit Does NOT Apply to IPSec VPN Certificates (Today)
Even though DigiCert said “no exceptions, applies to all environments”, that answer is technically correct only for certificates issued under the CA/Browser Forum rules (i.e., public TLS server certificates).
✔ CA/B Forum rules apply to public, browser-trusted certificates.
✘ They do not apply to:
IPSec VPN certificates are not governed by CA/B Forum rules unless you are doing something very unusual—like using a publicly-trusted certificate from DigiCert for IKE authentication, which almost no enterprises do.
This is why you’re hearing contradictory answers:
Support reps answer literally (“all environments”), but the CA rules do not apply to non-browser use cases.
✅ 2. Will there be exceptions in the future?
Most likely no, because IPSec VPNs are not in scope to begin with.
Vendors like DigiCert follow:
-
CA/B Forum Baseline Requirements → for public TLS
-
Their own PKI policies → for private PKI, code signing, device identity, VPN usage
The 47-day limit is only for public TLS certificates.
VPN certs generally come from:
Those can still have:
✅ 3. Will other certificate authorities follow the 47-day rule?
For publicly-trusted TLS?
Yes, 100%—they have no choice. The CA/B Forum mandated it.
For IPSec VPN certificates?
No. They are outside the scope.
✅ 4. Will Check Point, Cisco, Palo Alto, Fortinet etc. need to modify IPSec VPN certificate handling?
Not for this rule.
Why? Because none of them require or expect:
They all expect:
Check Point specifically:
Check Point’s documentation explicitly says:
Use internal CA or private CA for VPN certificate enrollment.
Public CAs are barely mentioned outside HTTPS inspection.
❗ 5. What will require major vendor changes?
✔ Cisco’s announcement about removing pre-shared keys
This is a completely separate initiative (cryptographic hardening).
Cisco is pushing:
If others follow—and they likely will over the long term—this increases:
But this still does NOT require short-lived certificates.
Vendors expect:
❗ 6. Why DigiCert told you “47 days affects all environments”
Because:
-
Their support reps answer according to the public TLS policies, not the technical PKI context.
-
Many customers mistakenly use public TLS certs for non-browser purposes, so support gives a safe universal answer.
-
The internal/private CA products are not being forced to 47-day validity.
💡 7. Your concern about operational overhead is valid
You wrote:
"If the single cert is used on multiple VPNs… admins, peer admins, testers, business outages… takes weeks"
Yes—certificate-based IKE authentication is operationally painful unless you automate it.
The only realistic long-term solution is:
-
Automated enrollment (SCEP, EST, CMPv2)
-
Automated push to both VPN peers
-
Automated rekeying
-
Avoiding public CAs entirely for IKE
Check Point already supports:
They do NOT expect you to rotate IKE certs every 47 days.
⭐ Bottom Line
The 47-day certificate lifetime does not apply to IPSec VPN certificates.
You can safely use:
-
Internal CA
-
Private DigiCert CA
-
1–3 year validity certs
No firewall vendor currently intends to enforce 47-day IPSec certificate renewals.
Best,
Andy
