diff --git a/confluent_server/confluent/config/attributes.py b/confluent_server/confluent/config/attributes.py
index 7f14fdcc..efbc4cb9 100644
--- a/confluent_server/confluent/config/attributes.py
+++ b/confluent_server/confluent/config/attributes.py
@@ -667,7 +667,7 @@ node = {
         'description': ('Fingerprint of the TLS certificate for service running on host.'),
     },
     'pubkeys.tls_lifetime': {
-        'description': ('When granting a certificate to the node or related BMC, this is the validity in days.  Default is 45 days.'),
+        'description': ('When granting a certificate to the node or related BMC, this is the validity in days.  Default is 47 days.'),
     },
     'pubkeys.ssh': {
         'description': ('Fingerprint of the SSH key of the OS running on the '
diff --git a/confluent_server/confluent/discovery/handlers/redfishbmc.py b/confluent_server/confluent/discovery/handlers/redfishbmc.py
index e2a9d008..cf5ca438 100644
--- a/confluent_server/confluent/discovery/handlers/redfishbmc.py
+++ b/confluent_server/confluent/discovery/handlers/redfishbmc.py
@@ -328,7 +328,9 @@ class NodeHandler(generic.NodeHandler):
         if hwmgt_method != 'redfish':
             return
         tls_lifetime = self.configmanager.get_node_attributes(nodename, 'pubkeys.tls_lifetime')
-        tls_lifetime = tls_lifetime.get(nodename, {}).get('pubkeys.tls_lifetime', {}).get('value', 45)
+        tls_lifetime = tls_lifetime.get(nodename, {}).get('pubkeys.tls_lifetime', {}).get('value', 47)
+        if not tls_lifetime:
+            tls_lifetime = 47
         tls_lifetime = int(tls_lifetime)
         proc = await asyncio.create_subprocess_exec(
             '/opt/confluent/bin/nodecertutil', nodename, 'signbmccert', '--days', str(tls_lifetime)
diff --git a/confluent_server/confluent/plugins/hardwaremanagement/redfish.py b/confluent_server/confluent/plugins/hardwaremanagement/redfish.py
index c38745e8..37cde652 100644
--- a/confluent_server/confluent/plugins/hardwaremanagement/redfish.py
+++ b/confluent_server/confluent/plugins/hardwaremanagement/redfish.py
@@ -599,7 +599,7 @@ class IpmiHandler:
                 tls_lifetime = self.inputdata.get_days(self.node)
             except KeyError:
                 tls_lifetime = self.cfm.get_node_attributes(self.node, 'hardwaremanagement.manager_tls_lifetime')
-                tls_lifetime = tls_lifetime.get(self.node, {}).get('hardwaremanagement.manager_tls_lifetime', {}).get('value', 45)
+                tls_lifetime = tls_lifetime.get(self.node, {}).get('hardwaremanagement.manager_tls_lifetime', {}).get('value', 47)
                 tls_lifetime = int(tls_lifetime)
             with tempfile.NamedTemporaryFile() as tmpfile:
                 tmpfile.write(csr.encode())
diff --git a/confluent_server/confluent/selfservice.py b/confluent_server/confluent/selfservice.py
index a8bdff19..73148cb6 100644
--- a/confluent_server/confluent/selfservice.py
+++ b/confluent_server/confluent/selfservice.py
@@ -420,7 +420,9 @@ async def handle_request(req, make_response, mimetype):
             certfile.close()
             subj = '/CN={0}'.format(nodename)
             tls_lifetime = cfg.get_node_attributes(nodename, 'pubkeys.tls_lifetime')
-            tls_lifetime = tls_lifetime.get(nodename, {}).get('pubkeys.tls_lifetime', {}).get('value', 45)
+            tls_lifetime = tls_lifetime.get(nodename, {}).get('pubkeys.tls_lifetime', {}).get('value', 47)
+            if not tls_lifetime:
+                tls_lifetime = 47
             tls_lifetime = int(tls_lifetime)
             await certutil.create_certificate(None, certname, tmpfile.name, subj, principals_to_san(pals), backdate=False,
                                         days=tls_lifetime)