Certificate lifecycle management is now an identity governance issue

At a glance

What this is: This is a certificate lifecycle management analysis that shows why CLM has shifted from a tooling task to an identity governance problem as 47-day TLS, continuous discovery, and post-quantum reissuance reshape operational risk.

Why it matters: It matters because certificate inventory, renewal cadence, revocation, and policy enforcement now directly affect machine identity reliability, auditability, and outage prevention across NHI and workload estates.

By the numbers:

• The annual renewal volume at a 47-day lifetime is roughly 27,000 events for a typical mid-market enterprise, a 7.9x increase from the current 398-day cadence.
• The CA/Browser Forum approved a phased reduction of public TLS certificate lifetimes from 398 days today down to 47 days by 2029.

Context

Certificate lifecycle management, or CLM, covers discovery, issuance, renewal, monitoring, and revocation for digital certificates across an enterprise estate. The governance gap is simple: when certificates are tracked manually or only partially discovered, expiry becomes an availability event rather than a controlled identity lifecycle.

This article treats certificate lifecycle management as an identity governance issue because certificates authenticate workloads, services, devices, and internal systems. As certificate lifetimes shorten and post-quantum reissuance begins, the control problem shifts from annual upkeep to continuous lifecycle enforcement.

The result is that certificate operations now look more like NHI governance than isolated infrastructure administration. Teams that cannot maintain inventory, policy, and revocation discipline will struggle to keep machine identities trustworthy at enterprise scale.

Key questions

Q: What breaks when certificate lifecycle management is still manual?

A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up. Services fail when a certificate expires, teams lose visibility when ownership is fragmented, and outage response becomes reactive instead of governed. The result is avoidable downtime, repeated exceptions, and an estate that grows faster than the people managing it.

Q: Why does 47-day TLS create a governance problem instead of just more work?

A: Because shorter validity periods multiply renewal events and compress the time available to detect, approve, issue, and deploy certificates. When those steps are handled manually, the control breaks at scale and service availability becomes dependent on operational luck rather than repeatable governance.

Q: What are the signs that certificate management is failing in practice?

A: Common warning signs include expired certificates, frequent renewal delays, inconsistent installations, and heavy reliance on spreadsheets or ad hoc tracking. Teams may also see increased manual intervention, poor visibility into certificate inventory, and difficulty proving compliance. When private keys are not managed consistently, the environment becomes more fragile and harder to secure at scale.

Q: How should security teams prepare certificate estates for post-quantum migration?

A: Start with inventory, dependency mapping, and lifecycle automation. Teams need to know which applications, devices, and machine identities depend on each trust chain before they can safely introduce post-quantum algorithms. Without that visibility, migration becomes reactive, with outages and policy drift happening after the change instead of before it.

Technical breakdown

Why shorter TLS lifetimes turn certificates into lifecycle assets

Certificates stop behaving like occasional infrastructure objects once renewal windows collapse from 398 days to 47 days. At that point, issuance, deployment, validation, and revocation become repeating identity events, not one-time administration. The technical problem is not the certificate format itself but the coordination burden across load balancers, public CAs, internal PKI, and workload endpoints. Any gap in deployment or inventory creates an outage path. That is why CLM must operate as a governed lifecycle with reliable state, not as a ticket queue or spreadsheet.

Practical implication: treat certificate renewal as continuous identity operations, not a calendar reminder process.

Why continuous discovery is the control plane for machine identity

Continuous discovery is the foundation of CLM because no team can govern what it cannot inventory. Real discovery spans cloud key vaults, active endpoints, internal CAs, certificate transparency logs, and external issuers so that shadow certificates and undocumented chains are visible before they fail. Without that coverage, renewal automation and revocation workflows only protect the subset already known to the platform. Discovery is therefore not a reporting feature; it is the prerequisite state model for certificate governance.

Practical implication: establish estate-wide discovery before attempting renewal automation or policy enforcement.

How crypto-agility changes certificate governance during PQC migration

Post-quantum migration turns certificate management into algorithm transition management. Hybrid certificates that carry both classical and post-quantum algorithms are the practical bridge because they allow interoperation while systems, regulators, and trust anchors evolve. That means CLM must abstract algorithms, support reissuance at scale, and preserve policy consistency across the old and new cryptographic eras. A platform that can only manage today’s algorithms will become a migration bottleneck when reissuance accelerates across the estate.

Practical implication: evaluate whether your CLM can reissue certificates across algorithm changes without rebuilding the governance process.

Threat narrative

Attacker objective: The objective is not attacker compromise but operational disruption through broken certificate trust and failed authentication.

1. Entry occurs when an expired or undiscovered certificate reaches a production service and breaks authentication or service trust.
2. Escalation follows when manual renewal and fragmented inventories delay replacement across servers, load balancers, or internal endpoints.
3. Impact is outage, failed authentication, emergency remediation, and avoidable operational cost across the estate.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Certificate lifecycle management has crossed from infrastructure hygiene into identity governance. Certificates now authenticate workloads, services, devices, and internal platforms, so expiry, revocation, and issuance are lifecycle controls rather than back-office administration. When the certificate estate is not continuously governed, the organisation is not merely risking downtime; it is losing control over machine identity trust.

47-day TLS creates certificate blast radius. A renewal regime that was survivable at annual cadence becomes fragile when renewal events multiply into the thousands. The issue is not that certificates become harder to issue, but that every partial inventory, delayed deployment, and orphaned endpoint now has more opportunities to fail before the next cycle arrives.

Continuous discovery is the named concept that separates CLM from spreadsheet management. If a platform only knows the certificates it issued, it is governing a subset of the estate rather than the estate itself. That is the difference between lifecycle control and reactive bookkeeping, and practitioners should judge CLM tools on estate completeness before automation promises.

Crypto-agility is now a governance requirement, not a future optimization. PQC migration means existing certificates will need reissuance even when nothing is technically broken, so the lifecycle must absorb algorithm transition as part of normal operations. Practitioners should rethink certificate governance as a repeatable trust migration process, not as an occasional renewal event.

Policy-as-code is becoming the only scalable audit model for certificates. Human review cannot keep pace when validity periods shrink and reissuance accelerates. The practical implication is that enterprises need enforcement at issuance time and machine-generated evidence at renewal time, or compliance will lag behind operational reality.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Machine Identity, PKI and Certificate Lifecycle Guide

What this signals

Certificate blast radius: When validity windows compress, every missed inventory record becomes a potential outage, so the practical control point moves from renewal day to discovery and issuance governance.

The current certificate model assumes that renewals are infrequent enough for humans to coordinate manually, but that assumption breaks as 47-day TLS approaches and PQC reissuance adds another wave of lifecycle churn. Teams should expect certificate governance to merge with broader machine identity management rather than remain a standalone ops function.

For practitioners

• Build continuous certificate discovery Scan cloud key vaults, load balancers, internal CAs, certificate transparency logs, and active endpoints so shadow certificates are visible before they expire or drift out of policy.
• Automate renewal and deployment end to end Use protocol-native automation such as ACME, EST, or SCEP so renewal includes validation, issuance, and deployment instead of stopping at certificate creation.
• Validate hybrid PQC issuance now Test whether the platform can issue hybrid certificates that carry both classical and post-quantum algorithms without manual workarounds or roadmap dependence.
• Express certificate policy as code Define validity periods, allowed algorithms, key sizes, EKUs, and naming conventions in policy that is enforced at issuance and produces automatic audit evidence.
• Run a renewal storm exercise Schedule a high-volume renewal test in a staging environment to see whether the platform can survive a 47-day cadence without bottlenecks or failure.

Key takeaways

• Certificate lifecycle failures are now an identity governance problem because certificates authenticate the services and workloads that modern enterprises rely on.
• The operational burden is rising sharply as 47-day TLS drives renewal frequency far beyond what manual tracking can sustain.
• Continuous discovery, automated renewal, and policy enforcement at issuance are the controls most likely to prevent expiry-driven outages.

Key terms

• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.
• Policy as Code: Policy as code stores authorization logic in version control and evaluates it through testable, reviewable rules. For agent governance, it makes runtime decisions reproducible and measurable, which is critical when actions can be triggered by untrusted content and executed at machine speed.

Deepen your knowledge

NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.