TL;DR: SSL/TLS certificate validity is moving from 398 days to 47 days by 2029, while many organisations still rely on manual certificate management that cannot keep pace with rotation, inventory, and renewal pressure, according to GlobalSign. The operational shift makes certificate lifecycle governance a workload identity problem as much as a PKI problem.
At a glance
What this is: GlobalSign argues that shortening SSL/TLS certificate lifecycles will outpace manual management and force stronger automation across inventory, renewal and revocation.
Why it matters: IAM, PKI and cloud security teams need to treat certificate lifecycle control as operational identity governance, because brittle renewal processes become outage and trust risks as validity windows shrink.
Context
SSL/TLS certificate management is moving from a periodic administration task to a continuous governance problem. When validity windows shorten, the risk is no longer just expired certificates, but missed renewals, incomplete inventory and inconsistent revocation across services, platforms and environments.
That shift matters to identity teams because certificates are machine identities in practice. As lifecycle pressure increases, the control challenge moves from individual certificate handling to inventory completeness, automated renewal and policy-based ownership across workloads, services and infrastructure.
Key questions
Q: What breaks when SSL certificate lifecycle management is not in place?
A: When certificate lifecycle management is weak, services can fail at expiry, trust chains can degrade silently and users may lose confidence in the site or application. The issue is not just a browser warning. It is a governance gap that leaves ownership, monitoring and renewal undefined, which turns certificates into hidden operational risk.
Q: Why do certificate inventories matter more as certificate validity periods shrink?
A: Because inventory is the prerequisite for lifecycle control. If teams cannot see every certificate in use, they cannot renew, rotate or revoke it on time, and they also cannot assign ownership or risk. Shorter validity periods make incomplete inventory a direct trust and uptime problem rather than a documentation issue.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
Q: Should certificate governance sit with PKI teams or workload owners?
A: It should be shared, with PKI setting policy and automation standards while workload owners retain service accountability. Certificates support machine identities embedded in applications and infrastructure, so renewal cannot remain a central team’s isolated task. The best model combines central governance with local ownership of service impact.
Technical breakdown
Why shorter certificate lifetimes break manual operations
A certificate lifecycle is the full path from issuance to renewal, replacement and revocation. Manual processes tend to assume there is enough time for human tracking, ticketing and approvals, but shorter validity windows compress that margin sharply. The failure mode is not cryptography itself. It is operational drift: inventories go stale, owners change, and renewal steps happen too late or in the wrong place. In practice, this turns certificate management into a continuous control problem rather than a calendar-based one.
Practical implication: shift certificate ownership from ad hoc administration to automated lifecycle control with clear service accountability.
Certificate inventory is the real control surface
Once certificate lifetimes shorten, the important question becomes whether an organisation can even see every certificate it depends on. Certificates are often scattered across cloud services, internal applications, gateways, endpoints and third-party integrations, which makes manual spreadsheets and one-off audits unreliable. In governance terms, the inventory is the control surface because you cannot renew, replace or revoke what you have not found. Weak inventory also creates hidden exposure when certificates are renewed inconsistently across environments.
Practical implication: build a continuously updated certificate inventory before tightening renewal policy or shortening validity further.
Why machine identity governance now includes PKI operations
A certificate is a machine identity credential, so certificate lifecycle failures are also workload identity failures. That makes the issue adjacent to NHI governance even when the article is framed as PKI or TLS management. If certificates are used by applications, services and automation, then renewal timing, ownership and revocation affect trust between systems in the same way that access governance affects human identities. The operational risk is that identity assurance decays faster than the teams managing it can react.
Practical implication: align PKI operations with machine identity governance so certificate lifecycle decisions reflect service identity risk.
Threat narrative
Attacker objective: The end state is usually disruption of trusted service communication or exploitation of weak certificate governance rather than theft of a certificate alone.
- Entry occurs when certificates are issued or deployed across services without strong lifecycle automation or complete inventory control.
- Credential access happens when expired, duplicated or poorly managed certificates create trust gaps, failed authentication or lingering exposure windows.
- Impact follows when services lose trust, renewals are missed or certificate failures interrupt production systems and machine-to-machine communication.
Breaches seen in the wild
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
- CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Certificate lifecycle compression is a machine identity governance issue, not just a PKI housekeeping problem. When validity windows shrink, the decisive control becomes whether every certificate has an owner, a source of truth and an automated renewal path. Organisations that still treat certificates as isolated admin objects will find that trust failures surface faster than manual processes can absorb them.
Inventory completeness is the named concept here: hidden certificates create hidden trust risk. A certificate estate that cannot be fully enumerated cannot be fully governed, especially when services are deployed across cloud, DevOps and hybrid environments. The practical conclusion is that certificate visibility must be treated as a security control, not a reporting exercise.
Manual renewal models assume enough human time exists to notice and fix every expiring certificate. That assumption is weakening as lifecycles shorten and certificate sprawl grows. The governance lesson is that lifecycle ownership, not just cryptographic strength, will determine whether TLS trust remains reliable at scale.
Certificate lifecycles now sit at the intersection of PKI, IAM and workload identity. This makes them a useful test case for broader identity governance maturity because the same organisation that cannot automate certificate replacement will struggle with other non-human credentials as well. Practitioners should read this as a warning about control fragmentation across machine identity estates.
What this signals
Certificate lifecycle compression will expose organisations that still treat TLS trust as an occasional maintenance task. The practical response is to move certificate management into continuous controls, with discovery, ownership and renewal automation tied to service risk rather than calendar cycles.
Machine identity governance now extends into PKI operations. Teams that already manage service accounts, tokens and workload identities should use the same governance discipline for certificates, because certificate expiry and revocation failures produce the same kind of operational trust breakdown.
Inventory completeness is the control that separates resilient certificate programmes from brittle ones. A service can only renew or revoke what it can see, so the first maturity test is whether certificate visibility is continuously maintained across cloud, DevOps and hybrid estates.
For practitioners
- Automate certificate discovery and renewal Replace spreadsheet-driven tracking with continuous discovery, renewal workflows and expiry alerting across cloud, application and infrastructure estates.
- Assign explicit certificate ownership Map each certificate to a service owner, renewal owner and escalation path so accountability survives staff turnover and platform sprawl.
- Inventory machine identities alongside certificates Treat certificates as part of the wider machine identity estate, including where they support APIs, services, gateways and automation flows.
- Prioritise high-risk expirations first Rank certificates by business criticality, external exposure and renewal complexity so the most fragile trust paths are handled before shorter lifecycles compress further.
Key takeaways
- Shortening SSL/TLS lifecycles turns certificate management into a continuous governance problem, and manual renewal processes lose reliability as the window narrows.
- Certificate inventory is the foundational control because lifecycle actions cannot be automated consistently when certificates are still hidden across services and environments.
- Practitioners should align PKI operations with machine identity governance so certificate ownership, renewal and revocation are treated as service risk controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Shortening certificate lifetimes makes unautomated certificate renewal a lifecycle control failure. |
| NHI-10 — Human Use of NHI | Manual certificate handling is a human-operated control over machine identity credentials. | |
| Recommendation — Automate certificate renewal and replacement before expiry windows become operationally unsafe. Reduce human handling of certificates and move issuance, renewal and revocation into governed automation. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificates function as authenticators and need lifecycle management under IA-5. |
| Recommendation — Apply authenticator management controls to certificate issuance, renewal, rotation and revocation. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Certificate lifecycle governance is part of cryptographic operational control. |
| Recommendation — Document cryptographic lifecycle responsibilities for certificates and enforce renewal governance. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Certificate exposure and misuse can support credential-based abuse of trusted services. |
| Recommendation — Track exposed or stale certificates as credential-access risk in threat detection and response. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Certificate Inventory: A certificate inventory is the authoritative list of all certificates in use across an environment, including owner, expiry, issuing authority, and deployment location. It is the control foundation for monitoring and renewal because teams cannot govern what they cannot reliably enumerate.
- PKI Lifecycle Automation: PKI lifecycle automation is the process of issuing, renewing, reissuing, deploying, and retiring certificates through policy-driven workflows rather than manual handling. It reduces expiry risk and operational drift, but only if the automation is governed so that credentials are not exposed inside the process.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity and security practitioners connect lifecycle control to broader programme accountability.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org