TL;DR: CA/B Forum policy will shorten public TLS certificate lifetimes from 398 days to 200 days in 2026, 100 days in 2027, and 47 days by 2029, compressing renewal windows and exposing manual lifecycle weaknesses, according to CyberArk. The real issue is not certificate duration itself, but whether identity governance can sustain continuous renewal, inventory, and ownership at machine scale.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on CyberArk's blog post: The coming 47-day TLS certificate cycle exposes an operational gap in manual certificate renewal processes.
Why it matters: It matters because certificate lifecycle management is now an identity governance problem for machine identities, and teams that cannot automate inventory, ownership and renewal will accumulate preventable outage and risk exposure.
Context
TLS certificate lifecycles are moving from periodic administration to continuous governance. As public certificate validity shrinks, the hard problem is no longer policy awareness but whether the organisation can track every certificate, assign ownership, and renew without interruption across hybrid and cloud environments.
For machine identity programmes, this is a classic lifecycle stress test. Public TLS certificates are non-human credentials, so the same discipline that governs service accounts and secrets now has to handle shorter expiries, higher renewal frequency, and operational dependency across applications, platforms and business services.
Key questions
Q: What breaks when certificate lifetimes shrink to 47 days?
A: Manual certificate processes break first, followed by renewal consistency, deployment timing, and outage tolerance. When certificates behave like short-lived machine identities, any gap in inventory or ownership becomes an operational failure, not just an administrative delay. Security teams need automated issuance, deployment, and revocation to keep trust continuous.
Q: Why do shorter certificate lifecycles increase operational risk?
A: Shorter lifecycles increase risk because they compress the time available for human coordination, which exposes weak inventory, unclear ownership, and inconsistent deployment paths. When renewal windows tighten, any manual dependency can become an outage. Automation reduces that risk by making lifecycle actions predictable and repeatable.
Q: How do teams know whether certificate automation is actually working?
A: Look for fewer human-mediated renewals, cleaner ownership records, lower expiry-driven outage rates, and reliable reporting across hybrid systems. If certificate work still depends on spreadsheets, ad hoc tickets, or last-minute interventions, the automation layer has not replaced the underlying operational risk.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
Technical breakdown
Why 47-day TLS lifecycles turn renewal into a continuous control
Public TLS certificates are no longer managed on an annual cadence. When validity drops to 200 days, then 100 days, then 47 days, renewal becomes a standing operational control rather than a calendar task. That changes the control objective from avoiding expiry once a year to maintaining uninterrupted lifecycle coverage across all certificate-bearing assets. The governance challenge is not the certificate format itself. It is the need for always-current inventory, ownership mapping, policy enforcement and renewal execution at volume.
Practical implication: replace ad hoc certificate calendars with continuous lifecycle controls and an authoritative certificate inventory.
Why manual certificate renewal breaks at machine scale
Manual renewal depends on people noticing expiry windows, coordinating with application owners, and completing replacement before service impact. That model fails when renewal frequency rises faster than teams can reliably track, validate and deploy changes. The article’s core warning is operational: the workload expands as lifecycles shorten, but the human process does not scale at the same rate. The result is not just extra effort. It is a growing probability of expired certificates, misaligned ownership, and service interruption in distributed environments.
Practical implication: use policy-driven automation for renewal, validation and deployment before the shorter lifecycle becomes routine.
How certificate automation becomes identity governance for NHIs
TLS certificates are machine credentials, so their lifecycle sits inside non-human identity governance rather than being a separate infrastructure task. In practice, certificate management has to cover issuance, renewal, replacement, revocation and ownership changes across application, cloud and hybrid estates. That is why the article ties automation to resilience and governance at the same time. Without lifecycle automation, certificates become unmanaged credentials that outlive their operational assumptions and create avoidable failure points in the identity fabric.
Practical implication: govern TLS certificates as machine identities with lifecycle ownership, renewal policy and revocation discipline.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
47-day TLS validity creates a lifecycle governance problem, not just a PKI problem. The shorter the certificate term, the more certificate management behaves like NHI lifecycle governance and less like occasional infrastructure maintenance. Manual renewal assumptions break because the control surface now includes discovery, ownership, rotation timing and deployment coordination across many systems. The practitioner conclusion is clear: certificate governance has to be continuous, not periodic.
Manual renewal is the real failure mode this policy change exposes. The article is not warning about TLS itself, but about the operational inability to renew at the new cadence without interruption. That failure mode is visible in the source’s emphasis on automation, policy alignment and renewal coordination. The practitioner conclusion is that ownership without automation becomes a liability once the renewal interval compresses.
Certificate blast radius expands as validity contracts. Every additional renewal event increases the chance that one missed asset, one stale owner, or one delayed deployment becomes a business outage. This is why certificate lifecycle management now sits at the intersection of availability, governance and identity control. The practitioner conclusion is to measure readiness by how many certificate changes can be executed reliably, not by how many certificates are merely discovered.
Machine identity programmes must treat certificate expiry as a governance signal. The article’s strongest implication is that certificate lifetime reduction surfaces hidden gaps in inventory quality, policy enforcement and operational ownership. A programme that cannot prove who owns each certificate and how renewal happens is already behind. The practitioner conclusion is to use the 47-day shift as a maturity test for machine identity governance.
47-day TLS certificate lifecycles are an identity operations test for the wider estate. The shortened term does not just affect public websites. It pressures the discipline around every machine credential that depends on timely renewal, clear ownership and reliable execution. For practitioners, the lesson is to align certificate governance with the same lifecycle rigour applied to other non-human credentials.
What this signals
Continuous certificate governance is now the baseline expectation: teams that still treat renewal as a periodic task will struggle once certificate validity contracts further. The practical shift is from tracking expiry dates to managing a live renewal pipeline across public and internal machine identities.
Automation now matters because the control problem is operational continuity, not policy awareness. When certificate lifecycles shorten, the governance question becomes whether the organisation can sustain ownership, deployment and recovery without human-dependent delays.
For practitioners
- Build a complete certificate inventory Map every public TLS certificate to an owner, expiry date, issuing CA and dependent service so renewal work is visible before the shorter lifecycle arrives.
- Automate renewal and deployment workflows Remove manual handoffs from renewal, validation and installation paths so certificate replacement can occur without waiting on individual operators.
- Assign named ownership for every certificate Tie each certificate to a responsible team or service owner, including inherited certificates created through mergers, acquisitions or cloud expansion.
- Test expiry failure scenarios before the deadline Simulate missed renewals, delayed approvals and deployment lag to see which business services fail when certificate replacement slips.
- Measure renewal load against operational capacity Compare upcoming certificate renewal counts with staffing and automation capacity to identify where the current process will break first.
Key takeaways
- Shorter TLS certificate lifecycles expose a governance gap in how organisations own, track and renew machine credentials.
- The main risk is not the new validity period itself, but the inability of manual processes to scale with renewal frequency.
- Automation, authoritative inventory and named ownership are the controls that determine whether certificate lifecycle changes remain invisible or become outages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Shortening lifetimes exposes the risk of certificates persisting too long without automated renewal. |
| NHI-01 — Improper Offboarding | Expired or orphaned certificates behave like unmanaged machine identities with unclear ownership. | |
| Recommendation — Automate certificate rotation before expiry windows shrink below manual handling capacity. Revoke and replace orphaned certificates when service ownership changes or disappears. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate issuance, renewal and revocation are authenticator lifecycle controls under IA-5. |
| Recommendation — Apply IA-5 to enforce automated certificate lifecycle management and timely revocation. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certificate ownership and renewal responsibilities map to disciplined account and lifecycle management. |
| Recommendation — Use account management controls to keep certificate owners, renewals and revocations current. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Expired or exposed certificates create credential-access opportunities for attackers. |
| Recommendation — Map certificate exposure to TA0006 and prioritise assets with weak renewal discipline. | ||
Key terms
- TLS certificate lifecycle: The TLS certificate lifecycle is the end-to-end process of requesting, validating, issuing, renewing, and retiring a certificate. In practice, it is a governance process for machine-held trust that only works when ownership, automation, and expiry monitoring are defined before production deadlines arrive.
- Certificate Automation: Certificate automation is the use of policy-driven tools to discover, issue, renew, revoke, and report on digital certificates without relying on manual administration. It reduces expiry risk and improves consistency, but it only strengthens security when ownership, key handling, and audit evidence are built into the process.
- Machine Identity Governance: Machine Identity Governance is the discipline of controlling how non-human identities are created, used, monitored, and retired. It covers service accounts, API keys, certificates, tokens, workloads, and automation identities, with policies for ownership, lifecycle, least privilege, rotation, attestation, and auditability across cloud, application, and infrastructure environments.
- Renewal Window: The period before a contract expires when an organisation can renegotiate, reduce scope, or exit without penalty. Missing the window often turns a routine administrative task into a locked-in commitment, which is why notice periods matter as much as pricing.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org