TL;DR: SSL certificate lifetimes are shrinking toward 47 days, and AppViewX says that shift will turn manual renewal into an outage risk while limiting how long compromised or forgotten certificates can remain trusted. Certificate operations must become governed lifecycle processes, not calendar reminders.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on AppViewX's blog post: SSL certificate lifetimes are moving toward 47 days, and manual renewal will not scale without stronger discovery, automation, and ownership.
Why it matters: This matters because certificate expiry now sits squarely inside identity governance, where unmanaged lifecycles can break services, expose keys, and create blind spots across cloud estates.
By the numbers:
- The current maximum validity period for an SSL certificate is 398 days, roughly 13 months.
- The CA/Browser Forum will reduce maximum certificate lifetimes to 200 days by March 2026, then to 100 days by March 2027, and finally to 47 days by March 2029.
- All four major browser vendors, Apple, Google, Mozilla, and Microsoft, voted in favour of the 47-day certificate proposal.
Context
SSL certificates are machine identities that expire by design, so the governance problem is lifecycle control rather than authentication alone. When validity periods compress, the control surface shifts from occasional renewal to continuous inventory, ownership, and automated replacement.
The move toward 47-day lifetimes means that organizations cannot rely on periodic human review to keep certificates alive. Discovery, renewal, and audit evidence have to be treated as one operational system, not separate tasks.
Key questions
Q: How do you inventory SSL certificates across cloud and on-premise estates?
A: Inventory SSL certificates by combining automated discovery of certificates on load balancers, web servers, proxies, containers and managed cloud services with scans of certificate stores, configuration repositories and DNS-linked endpoints. Record issuer, subject, expiry, private key location, owner, environment and renewal process, then reconcile duplicates and orphaned certificates. This gives a single register for rotation, revocation and offboarding.
Q: Why do short-lived certificates reduce identity risk in large environments?
A: They shorten the period in which a forgotten, stale or misissued certificate can be used. That matters most when offboarding, contractor removal or device replacement is imperfect, because expiry acts as a backstop. The control is not a substitute for lifecycle governance, but it limits how long bad state can survive.
Q: What is the difference between certificate expiry and revocation?
A: Expiry ends trust automatically at a scheduled date, while revocation removes trust early because the certificate is no longer safe or appropriate to use. Expiry is time-based, but revocation is event-based and should happen when compromise, reassignment, or policy violation occurs. Both matter because a certificate can be current and still be wrong.
Q: How should teams prevent a certificate renewal failure from taking down a public website?
A: Teams should treat certificate renewal as an operational dependency, not a background task. Use automated renewal, but verify that the renewal path actually works in every relevant network path and protocol. Add independent expiry checks, redundant calendar reminders, and a manual renewal window. If a proxy, CDN, or IPv6 route sits in front of the origin, test that path separately.
Technical breakdown
Why shorter certificate lifetimes change the control model
Certificate validity is not just a date field. It defines how long a private key, trust chain, and deployment state remain acceptable before the ecosystem forces revalidation. As lifetimes shrink, the certificate itself becomes a short-lived operational credential rather than a long-term asset. That matters because any manual workflow now has to succeed repeatedly, at high frequency, across every environment where a certificate exists. The security value comes from reducing exposure time, but the operational cost comes from that same compression. The real issue is not whether certificates expire, but whether the organisation can prove ownership and renewal discipline continuously. See the ACME and Automated Certificate Management Guide.
Practical implication: Map every certificate to an owner, a renewal path, and an automated issuance workflow before shortening lifetimes in production.
How expiry and revocation failures create outage risk
An expired certificate does not fail quietly. Browsers, clients, APIs, and internal services all treat it as untrusted, which can break traffic, integrations, and certificate-dependent service flows. Revocation does not solve this by itself because revocation systems are uneven, and many deployments still rely on expiry as the backstop. When renewal timing drifts, the failure mode is binary: service continues or service stops. Shorter lifetimes intensify that failure mode because they leave less room for manual correction, delayed approvals, or unnoticed ownership gaps. The architecture therefore has to assume renewal will happen many times per year, not once in a long-lived cycle. See the Certificate Revocation Guide.
Practical implication: Design renewal paths so certificate replacement is routine and non-interactive, not dependent on a person noticing an expiry date.
Why certificate discovery becomes a governance control
Certificate sprawl is an inventory problem before it is a cryptography problem. Organisations frequently lose track of internal, external, cloud, and third-party certificates because they are deployed across teams and platforms with inconsistent ownership. Discovery matters because an unknown certificate cannot be renewed, rotated, or retired on time. In multi-cloud and hybrid estates, unmanaged certificates become orphaned infrastructure with hidden operational and security impact. The move to shorter lifetimes turns discovery into a mandatory control because every forgotten certificate will surface sooner, either through expiry or through operational failure. That makes inventory completeness the first proof of governance maturity, not an administrative detail. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Practical implication: Continuously discover certificates across cloud, internal, and third-party environments before enforcing shorter lifecycle policies.
Threat narrative
Attacker objective: The attacker or failure state is to preserve trust in a certificate long enough to enable interception, impersonation, or service disruption.
- Entry occurs when a certificate is forgotten, left undiscovered, or managed through a manual workflow that misses its renewal window.
- Escalation follows when the expired or compromised certificate remains in use across browser, API, or service connections that still trust it.
- Impact occurs when traffic breaks, encrypted sessions fail, or an attacker can keep using a trusted certificate longer than the organisation intended.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Imperva breach 2019: An AWS API key stolen from an exposed Imperva test instance let an attacker copy Cloud WAF customer data, including API keys and SSL certificates.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
47-day certificates convert certificate management from periodic hygiene into continuous identity governance. The shortening lifecycle does not merely increase operational work; it removes the room for informal ownership and delayed renewal. Programmes that treat certificates as static infrastructure will fail first, because the trust window is becoming shorter than their review cadence. The implication is that certificate governance now belongs in the same discipline as other lifecycle-controlled identities.
Certificate expiry is becoming an availability control, not just a security control. Expiration failures break API connections, browser trust, and internal service dependencies, so the outage dimension is inseparable from the identity dimension. That means renewal policy, monitoring, and service ownership need to be designed as one control surface. Teams that separate infrastructure uptime from certificate governance will keep rediscovering the same failure mode.
Certificate discovery is the named concept this transition exposes: if you cannot inventory every certificate, you cannot govern the lifecycle at 47-day speed. Multi-cloud estates make that gap larger because certificates are distributed across domains, platforms, and vendors with uneven ownership records. The practical implication is that discovery becomes the prerequisite control for every other PKI decision.
Short-lived certificates expose ownership drift faster than long-lived ones ever did. When a certificate expires every 47 days, missing accountability becomes visible quickly, and that visibility is the point. The governance challenge is not merely volume; it is whether IT, DevOps, and security can all recognise the same renewal responsibility before the deadline arrives. Organisations that rely on informal handoffs will see that assumption fail under the new cadence.
Read next: ACME and Automated Certificate Management Guide
What this signals
Certificate lifecycle speed is becoming the real governance test. As renewal intervals shrink, the question is no longer whether a team can renew a certificate, but whether it can prove continuous control over discovery, ownership, and replacement. Programmes that still depend on human memory will feel the pressure first because the lifecycle has become faster than the review process.
Short-lived machine identities force operations and security to converge. Certificate handling now sits between availability engineering and identity governance, which means renewal failures are both a service problem and a trust problem. The organisations that adapt fastest will treat certificate automation as core operating infrastructure, not a special-case exception.
For practitioners
- Centralise certificate discovery Scan domains, subdomains, internal systems, cloud estates, and third-party services so every certificate has an owner and a renewal path.
- Automate certificate renewal Replace calendar reminders and manual tickets with issuance workflows that renew and install certificates before expiry without human intervention.
- Set escalation-based expiry monitoring Create alerts weeks before expiry, route them to the accountable team, and escalate if no action is taken.
- Document certificate ownership and policy Assign a named owner for each certificate lifecycle and keep the renewal policy, runbook, and approval path aligned across IT, DevOps, and security.
- Test readiness at shorter cycles Validate the process against 200-day, 100-day, and eventually 47-day renewal windows before those deadlines become mandatory.
Key takeaways
- Shorter certificate lifetimes shrink the window for abuse but also remove the margin that manual renewal workflows depended on.
- The biggest operational risk is not the new validity period itself, but the discovery and ownership gaps it exposes across fragmented estates.
- Automated discovery, renewal, alerting, and ownership assignment are now core controls for certificate governance at scale.
Related NHI Mgmt Group resources: Machine Identity, PKI and Certificate Lifecycle Guide · Certificate Expiry Outages and 47-Day TLS Certificates Guide · ACME and Automated Certificate Management Guide · Certificate Revocation Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Long-lived certificates create the same governance risk as long-lived secrets in this certificate lifecycle transition. |
| NHI-01 — Improper Offboarding | Orphaned certificates mirror offboarding failures because trust objects outlive their owners. | |
| Recommendation — Shorten certificate lifetimes and automate renewal before long-lived trust material accumulates. Retire unused certificates promptly and enforce ownership checks when systems or teams change. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate renewal, rotation, and replacement are authenticator lifecycle controls under IA-5. |
| Recommendation — Apply IA-5 to automate certificate rotation, renewal, and revocation across environments. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate trust and renewal governance determine which services remain authorised to connect. |
| Recommendation — Review certificate-based access paths continuously so expired or orphaned identities lose trust on time. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certificate ownership and lifecycle control are account-management problems for machine identities. |
| Recommendation — Track certificate owners and enforce lifecycle review for every active machine credential. | ||
Key terms
- SSL Certificate: An SSL certificate is a digital credential that proves a website or service controls a specific domain and enables encrypted connections. In practice, it is a public key certificate used in TLS to authenticate the server, support trust decisions, and protect data in transit between clients and online systems.
- Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- ACME: ACME is a protocol used to automate certificate issuance and renewal between a client and a certificate authority. For practitioners, it reduces manual renewal work, but it also introduces a dependency on correct client configuration, credential handling, and monitoring of the automation path.
Deepen your knowledge
NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org