OCI firewall gains multi-certificate TLS inspection as public certificate lifetimes shrink to 47 days

Multi-certificate TLS inspection arrives in OCI Network Firewall

Oracle's cloud network firewall now accepts multiple certificate references for TLS inspection, an update Oracle Cloud Infrastructure published on August 25, 2026. Multiple certificate references can make it easier to align decryption policy with real certificate ownership, rotation, and application lifecycle patterns. For operators running mixed fleets where one listener fronts services owned by different teams, the ability to pin inspection to the certificate that actually terminates a session reduces reliance on a single catch-all and gives security teams a lever when an individual cert is rotated or revoked.

Public TLS validity is already on a forced march toward 47 days

The longer story behind that firewall change is the steady compression of public TLS certificate lifetimes. According to a change log entry, public TLS certificates shrink to 47 days by March 2029, with an interim step already in force: the maximum lifetime dropped from 398 days to 200 days on March 15, 2026. The shift is the first of three cuts that move the industry from multi-year certificates toward a 47-day ceiling by March 2029. Operators who still anchor their change windows, monitoring thresholds, and budget cycles to annual rotations need to rebase those plans now.

Certificate authorities have already moved early

A separate industry note confirms the cut is not a future scenario. Public TLS validity dropped from 398 days to 200 days on March 15, 2026, the first of three cuts on the way to 47 days in March 2029, and most CAs moved early rather than waiting for the deadline. In practice that means a substantial share of certificates in the wild already carry lifetimes at or below 200 days even though the formal maximum sits at that level. Discovery of every certificate in an estate, and not just the ones a team remembers issuing, becomes the prerequisite for staying ahead of expirations rather than reacting to them.

Why this changes the operator's workflow

The combined effect is that manual renewal stops scaling before the final 47-day deadline. Manual renewal becomes untenable, discovery becomes a prerequisite for reliability, and validation-method choices start to matter on shorter horizons than they used to. Teams that treated TLS as a once-a-year chore have to treat certificate lifecycle as a continuous pipeline, and the firewall changes at the inspection boundary only deliver value if the rest of the estate already knows which certificates it owns, where they terminate, and who owns them. The new OCI capability addresses one slice of that problem, the inspection plane, but it does not by itself solve discovery or renewal automation.

What to check before the next cut lands

The next concrete deadline is the move from 200 days toward 47 days by March 2029, and the intervening steps are not evenly spaced, so operators cannot assume they have until the final date to react. Three actions are worth scheduling now: inventory every certificate actually serving traffic, including those behind TLS-inspection middleboxes; confirm the CA or ACME client in use already issues at the new shorter lifetimes so renewals do not collide; and verify that monitoring alerts are calibrated for the new validity floor so an unexpected short-lived certificate does not silently fail validation.

For ad-hoc work that touches encoding and hashing around certificate or key data, the SHA256 Hash Generator and AES Encryption Online tools cover the everyday primitives a practitioner reaches for during a rotation, while Decode Base64 from the Command Line Without Installing Anything and Text to Hex ASCII: Convert Strings to Hexadecimal Bytes help when reading raw certificate or key material line by line.