TL;DR: Certificate lifespans are shrinking from annual renewals to 200 days now and 47 days next, forcing approval cycles, ownership models, and deployment workflows to operate eight times as often, according to Keyfactor. The operational issue is not policy itself but the assumption that certificate lifecycle management can still be handled on a calendar cadence.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: Shrinking TLS certificate lifespans to 47 days exposes operating models built for slower renewal cadences.
Why it matters: It matters because certificate lifecycle management now affects applications, workloads, APIs and devices at a pace that manual ownership, approval and deployment processes may not sustain.
By the numbers:
- As of March 15, 2026, maximum TLS certificate lifespans dropped to 200 days, with 100 days next and 47 days in another two years.
Context
TLS certificate lifespans are shrinking, and that turns PKI from a periodic renewal task into a continuous governance problem. In practice, every shorter issuance window increases the burden on certificate inventory, approval routing, deployment timing and ownership clarity.
The article frames the shift as structural, not temporary. For identity and infrastructure teams, that means certificate lifecycle management has to be treated as shared operational infrastructure across applications, workloads, APIs, devices and customer-facing systems, not as an occasional admin task.
Key questions
Q: What breaks when certificate lifecycle management is not integrated with PKI operations?
A: Manual certificate management does not scale once certificate counts rise and lifetimes shrink. Without integrated lifecycle management, renewals become inconsistent, revocations lag, and teams lose visibility across internal, public, and cloud-native authorities. That creates outage risk and weakens trust assurance, especially in environments with many applications, workloads, and device identities.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption. If those steps are manual or fragmented, more frequent renewals increase the chance of missed deadlines and failed services. The risk is not the shorter lifetime itself. The risk is weak lifecycle discipline at higher tempo.
Q: How do teams know whether certificate governance is actually working?
A: Look for three signals: clean issuance records, consistent revocation propagation, and matching status across PKI, endpoint security, and operations. If a valid certificate is blocked or a revoked certificate remains trusted somewhere, governance is fragmented and the control model is failing.
Q: Should organisations prioritise automation or process redesign first for 47-day certificates?
A: Process redesign first, automation second. Automation only helps when ownership, approval paths and deployment responsibilities are already clear. Without that structure, the organisation automates confusion. The goal is a renewal model that can operate continuously, with automation reinforcing a governance design that already matches the shorter certificate lifecycle.
Technical breakdown
Why shorter certificate lifespans change PKI operating models
TLS certificate validity is the time a certificate remains acceptable for use before renewal or replacement is required. When lifespans compress from annual cycles to 200 days, 100 days and then 47 days, the operational burden rises non-linearly because renewal is not just cryptographic renewal. It also triggers approval, inventory checks, deployment coordination and ownership validation. The technical issue is not the certificate itself but the lifecycle machinery surrounding it. If that machinery still depends on tickets, manual reviews and human scheduling, the system will miss renewal windows even when the policy is sound.
Practical implication: Treat certificate lifecycle as a continuously operating control plane, not a calendar event.
Why manual approvals and spreadsheet tracking fail at 47 days
Manual workflows scale poorly when renewal cadence accelerates. A certificate estate that renews eight times as often creates overlapping windows, more handoffs and more chances for one delayed approval to cascade into expiry or service disruption. Spreadsheet tracking is especially fragile because it cannot reliably represent real-time ownership, deployment status or renewal dependency chains. In PKI terms, the control failure is not lack of policy. It is a mismatch between enforcement speed and operational latency. As cadence compresses, the gap between inventory, approval and deployment becomes the failure point.
Practical implication: Replace human-scheduled renewal chains with automated inventory, approval and deployment workflows.
How lifecycle agility reduces certificate risk
Lifecycle agility means certificates are managed as a continuous process from discovery through renewal and replacement, rather than as isolated expiration events. That requires accurate inventory, clear ownership and automation in the renewal path so policy changes do not create blind spots. The article’s core point is that shorter lifespans expose organizations that equate compliance with readiness. In reality, readiness depends on whether the organization can execute the entire certificate lifecycle at machine speed, across every environment where certificates are embedded.
Practical implication: Build certificate governance around continuous discovery, ownership and automated renewal execution.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shorter certificate lifespans are a PKI governance stress test, not just a security improvement. The policy objective is clear: reduce exposure by shortening the time a certificate can be abused. But the practical effect is that every organisation now has to prove its certificate lifecycle is operable under much tighter cadence. The field should stop treating this as a certificate-length debate and start treating it as a governance-readiness test for PKI itself.
The real control gap is calendar-based lifecycle management. Renewal models built around annual events assume enough slack for human approval, manual tracking and ad hoc deployment. That assumption fails when policy cycles tighten to 47 days because the operating model becomes the constraint, not the certificate. The implication is that PKI governance has to be judged by orchestration quality, not policy intent.
Lifecycle agility is becoming the decisive PKI capability. Certificate programs that can continuously discover, assign ownership and execute renewals will absorb the policy shift; programs that rely on heroics will not. This is less about cryptography than about whether digital trust infrastructure can move at enforcement speed.
Enforcement-speed mismatch: the defining governance concept here is the gap between policy cadence and organisational execution speed. The article shows that shorter certificate validity exposes that gap directly. Practitioners should treat any manual dependency in renewal, approval or deployment as a structural liability, not a process inconvenience.
Certificate governance is now shared infrastructure governance. The article correctly notes that certificates underpin applications, workloads, APIs and devices, which means failure is no longer isolated to one team. That broad dependency footprint makes lifecycle ownership a cross-domain control issue for IAM, PKI and platform operations alike.
What this signals
Lifecycle agility will separate resilient PKI programs from fragile ones. The organisations most exposed by shorter TLS validity are the ones still treating certificate renewal as a periodic admin task. As enforcement cadence tightens, continuous discovery, ownership and renewal orchestration become baseline requirements, not maturity extras.
Calendar-driven certificate management is becoming an anti-pattern. A governance model that depends on annual reviews or ad hoc renewals cannot absorb a shift to 200-day and then 47-day lifespans without accumulating delay. The practical signal for teams is simple: if your renewal process needs heroic intervention, the model has already fallen behind.
Certificate governance now spans the full identity and infrastructure stack. Because certificates protect applications, workloads, APIs and devices, the operational burden extends beyond a single PKI team. Teams should expect certificate lifecycle controls to be reviewed alongside broader identity and access governance, especially where ownership and deployment boundaries are unclear.
For practitioners
- Map certificate ownership across every renewal path Identify the business owner, technical owner and deployment owner for each certificate class so renewal responsibility does not disappear when cadence accelerates.
- Automate renewal and deployment workflows Remove manual ticket queues and spreadsheet handoffs from the renewal path, especially where certificates are embedded in applications, workloads, APIs and devices.
- Inventory certificates continuously Maintain a current certificate inventory that includes expiry, location, dependency and owner so short validity windows do not create blind spots.
- Replace heroics with orchestration Treat renewal as an operational pipeline with measurable handoff points instead of depending on individual responders to catch expiring certificates.
Key takeaways
- Shorter certificate lifespans expose a PKI operating model that still depends on slow human coordination rather than continuous control.
- The policy shift increases renewal frequency, overlap and ownership pressure across applications, workloads, APIs and devices.
- Organisations that want to avoid expiry-driven disruption need continuous inventory, clear ownership and automated lifecycle execution.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-57 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Short-lived certificate policy makes long-lived certificate management the core governance problem. |
| Recommendation — Replace long-lived certificate handling with automated renewal and expiry monitoring. | ||
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article is fundamentally about enforcing shorter cryptographic credential lifecycles. |
| Recommendation — Apply key lifecycle governance to certificate renewal, replacement and destruction. | ||
| CIS Controls v8 | CIS-5 — Account Management | Changing certificate ownership and renewal responsibility is an account and entitlement governance issue. |
| Recommendation — Document certificate owners and remove stale renewal accounts from the workflow. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Lifecycle Agility: The ability to manage identity artefacts through renewal, rotation, and offboarding at the pace required by policy. For certificates, lifecycle agility means the organisation can keep renewal, deployment, and verification aligned with enforcement cadence instead of depending on manual coordination.
- PKI Governance: PKI governance is the set of ownership, policy, inventory, and lifecycle controls that keep certificate-based trust reliable. It connects technical issuance and renewal processes to accountability, risk reporting, and service continuity, which is why it belongs inside identity governance rather than isolated infrastructure administration.
- Enforcement Speed: The rate at which policy is applied in practice. When enforcement speed exceeds the organisation’s renewal, approval or deployment speed, the gap becomes a reliability and governance risk even if the policy itself is sound.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 6, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org