TL;DR: By 2029, certificate validity will drop to 47 days, according to AppViewX, which forces organisations to inventory every certificate and automate renewal, validation and deployment before expiry becomes a routine outage risk. Certificate governance shifts from periodic maintenance to continuous operations, and the weakest assumption is that manual renewal can keep pace.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on AppViewX's blog post: Certificate lifetimes are shrinking to 47 days, making continuous inventory and renewal automation essential.
Why it matters: Practitioners responsible for PKI, workload identity and service availability need to treat certificate lifecycle management as an operational control, not an occasional renewal task.
By the numbers:
- The first reduction took effect in March 2026.
- The endpoint is 47 days, down from 398.
Context
Certificate lifetimes are moving from annual maintenance toward a cadence that demands continuous governance. The operational problem is not just expiry, but the gap between when certificates are discovered, owned and renewed.
For identity and access teams, this is a lifecycle issue as much as a PKI issue. Certificate lifecycle management has to cover discovery, ownership, renewal and deployment across every environment, or certificate sprawl turns into service interruption.
Key questions
Q: How should teams inventory machine certificates in hybrid environments?
A: Inventory machine certificates by binding each certificate to its owning workload, service account, or device, then record issuer, subject, serial number, key location, expiry, and renewal path across on-premises and cloud platforms. Use automated discovery from certificate stores, load balancers, containers, and cloud certificate services, then reconcile duplicates and orphaned certificates in a single estate. Enforce rotation, revocation, and ownership review so expired or unowned certificates do not persist.
Q: Why do expired certificates still cause outages in mature environments?
A: Expired certificates still cause outages because many environments rely on manual tracking, fragmented ownership, and renewal processes that do not match certificate growth. Mature teams often have policy, but not reliable execution. When the inventory is incomplete or the owner is unclear, the renewal event is missed and the service fails before remediation begins.
Q: How should organisations automate certificate renewal without losing control?
A: Automate the predictable parts of renewal, especially for low-risk certificates with repeatable trust paths, and keep human review for exceptions and high-impact systems. The goal is not to remove governance, but to move it earlier and make it explicit in workflow design instead of depending on manual follow-up.
Q: How should security teams respond to shorter certificate lifespans?
A: They should treat shorter lifespans as an automation mandate, not as a reason to add more manual review. The immediate priority is to inventory all machine identities, remove ticket-driven renewals, and enforce policy-based issuance and revocation. That approach reduces outages and creates a foundation for broader lifecycle governance.
Technical breakdown
Why shorter certificate lifetimes break manual renewal models
When certificate validity drops from a year to weeks, the renewal process stops being an occasional administrative task and becomes a repeatable control path. The technical strain is not only the renewal event itself, but the validation, deployment and rollback steps that must happen without human delay. If any one of those steps still depends on a person noticing an expiry ticket, the process becomes fragile again. That is why renewal automation is really a control design problem, not a scheduling problem. See the Certificate Expiry Outages and 47-Day TLS Certificates Guide.
Practical implication: Map every renewal step that still needs a human handoff and remove it before shorter lifetimes reach production.
Why certificate inventory becomes the first governance control
Certificate expiry failures usually start with unknown assets, not with weak cryptography. Certificates accumulate across cloud services, application layers, test environments and legacy infrastructure, while ownership gets lost during reorgs and system turnover. Inventory is therefore the control that makes the rest of certificate lifecycle management possible: you cannot renew, validate or report on what you cannot see. Discovery also exposes the forgotten certificates that most often drive outage risk. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Practical implication: Build an authoritative certificate inventory with expiry date, owner and environment for every certificate in use.
How crypto-agility links certificate lifecycle to future standards
Crypto-agility is the ability to change cryptographic standards without rebuilding the estate. In practice, that means certificates, trust chains and deployment processes must already be flexible enough to absorb provider changes and post-quantum migration without broad service disruption. Shorter certificate lifetimes help because they create a steady operational rhythm for re-issuing and redeploying trust material. That rhythm reduces the shock when standards shift, browser trust changes or post-quantum requirements arrive. Read Guide to SPIFFE and SPIRE.
Practical implication: Design certificate operations so provider changes and new cryptographic standards can be adopted without a full migration project.
Threat narrative
Attacker objective: The objective is not a traditional intrusion, but the operational failure that lets an expired certificate disrupt service availability and trusted access.
- entry: A certificate expiry is introduced into a live service because discovery missed the asset or ownership was never assigned.
- escalation: The renewal window closes before the certificate is replaced, so the service loses trusted access or fails authentication.
- impact: The expired certificate takes down the website, login flow or API path, causing outage, revenue loss and trust damage.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Certificate lifecycle has become a governance discipline, not a renewal chore. Shorter validity periods force ownership, discovery and automation into the same control plane because ad hoc renewal no longer scales. The organisations that treat certificates as governed infrastructure will absorb the change; those that treat them as tickets will absorb outages. The practical conclusion is that lifecycle ownership now matters as much as cryptographic strength.
Unknown certificates are the real exposure window. The operational risk is not only that a known certificate expires, but that an unseen certificate survives long enough to fail in production. That is why inventory is the named concept here: without complete discovery, renewal policy cannot be enforced and accountability cannot be assigned. The implication is that certificate governance starts with asset visibility, not with renewal dates.
Crypto-agility is being normalised by certificate churn. Frequent renewal cycles create the operational habit that future cryptographic transitions require. That means post-quantum migration becomes less about a one-time transformation and more about whether the environment can absorb standard changes on a routine basis. Practitioners should read shorter certificate lifetimes as an early test of whether their trust infrastructure can adapt without upheaval.
Certificate expiry is now a business continuity issue. Uptime, customer trust and deal assurance all depend on certificates remaining valid across every service path. When renewal frequency increases, leadership has to treat certificate operations as a funded resilience function rather than background administration. The conclusion is simple: if certificate governance is not measured and owned, it will eventually be discovered through downtime.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Certificate Expiry Outages and 47-Day TLS Certificates Guide
What this signals
Certificate operations are shifting from periodic cleanup to continuous control. The organisations that survive the 47-day model will be the ones that can prove inventory, ownership and renewal automation as a routine operating state, not an exception process.
Certificate churn will expose governance gaps faster than security teams expect. When renewals happen every few weeks, any missing owner, stale workflow or manual approval path becomes a recurring failure mode rather than a rare event.
Short validity periods turn renewal into a forcing function for certificate lifecycle management. The practical signal for IAM and infrastructure teams is that trust infrastructure must now be monitored like any other production dependency.
For practitioners
- Build a complete certificate inventory Track every certificate across web, application, cloud and internal services, with expiry date, owner and deployment location.
- Automate renewal before 100-day deadlines Remove manual approvals, file uploads and one-off renewals from the path so routine certificate replacement runs without a person intervening.
- Assign ownership for every certificate Make one team accountable for each certificate so reorgs, retirements and cloud sprawl do not leave assets orphaned.
- Plan for provider and standard changes Design certificate operations so a CA trust change or post-quantum migration can be executed as a normal lifecycle event.
Key takeaways
- Shorter certificate lifetimes turn lifecycle governance into an always-on operational requirement, not a yearly maintenance task.
- The main risk is not cryptographic weakness but unmanaged ownership, incomplete inventory and renewal paths that still depend on people.
- Teams that automate discovery, renewal and deployment will be better positioned for future standards changes and fewer expiry-driven outages.
Related NHI Mgmt Group resources: Machine Identity, PKI and Certificate Lifecycle Guide · Certificate Expiry Outages and 47-Day TLS Certificates Guide · Guide to SPIFFE and SPIRE
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Shorter certificate lifetimes directly reduce the risk of long-lived certificate exposure. |
| NHI-01 — Improper Offboarding | Orphaned certificates persist when services or owners are not cleanly retired. | |
| Recommendation — Shorten certificate validity and automate renewal so stale certificates do not remain usable for months. Track certificate owners and revoke or replace certificates when services are decommissioned. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate issuance, rotation and expiry are authenticator lifecycle controls. |
| Recommendation — Apply authenticator lifecycle controls to renew, replace and retire certificates before expiry. | ||
| NIST CSF 2.0 | ID.AM-02 — Software, Hardware and Data Assets are Inventoried | Complete certificate discovery depends on authoritative asset inventory. |
| Recommendation — Maintain an inventory of all certificate-bearing systems so renewal and reporting are based on current assets. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Stolen or expired certificate material affects credential access and trust abuse. |
| Recommendation — Monitor certificate exposure and treat compromised certificate material as credential-access risk. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Certificate Authority: A Certificate Authority is a trusted organisation that issues and signs digital certificates binding identities to public keys. Defenders rely on it to establish trust for TLS and other certificate-based systems, while attackers target weak issuance processes, stolen signing keys, or mis-issuance to impersonate services and users.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org