TL;DR: The CA/B Forum has approved a phased reduction in public SSL/TLS certificate validity to 47 days by 2029, with DCV reuse shrinking to 10 days by 2028, according to GlobalSign. The shift makes manual certificate handling increasingly untenable and turns automation, inventory, and lifecycle governance into core identity controls.
At a glance
What this is: GlobalSign explains that the CA/B Forum’s approved certificate policy changes will shorten public SSL/TLS lifetimes to 47 days and DCV reuse to 10 days, pushing organisations toward automation.
Why it matters: This matters because certificate issuance, renewal, and revocation are part of machine identity governance, and the shorter lifecycle will expose inventory gaps, manual process risk, and weak ownership.
By the numbers:
- The maximum validity period for public SSL/TLS certificates is currently 398 days.
- The certificate validity period will fall to 47 days by 2029.
- DCV reuse will shrink to 10 days by March 2028.
- A 398-day certificate issued before 15 March 2026 can still be trusted until it naturally expires.
Context
Certificate lifecycle governance is the operational layer that keeps public trust usable, current, and revocable. The article’s core message is that the industry is moving from long-lived certificates to short renewal windows, which changes certificate handling from occasional administration into continuous control.
For identity teams, this is a machine identity problem as much as a PKI problem. Certificates authenticate services, applications, and non-browser clients, so shorter lifetimes increase the importance of inventory, ownership, automation, and revocation workflows across the full lifecycle.
Key questions
Q: What breaks when certificate lifetimes shrink to 47 days?
A: Manual certificate processes break first, followed by renewal consistency, deployment timing, and outage tolerance. When certificates behave like short-lived machine identities, any gap in inventory or ownership becomes an operational failure, not just an administrative delay. Security teams need automated issuance, deployment, and revocation to keep trust continuous.
Q: Why does shorter SSL/TLS certificate validity reduce security risk for digital trust systems?
A: Shorter validity reduces the window in which a stolen or compromised private key can be abused. It also forces organisations to modernise certificate management practices that often rely on manual work and delayed response. The security benefit depends on timely rotation and revocation, because a shorter lifetime only helps when the surrounding process can actually keep pace with it.
Q: What are the signs that certificate lifecycle processes are not working properly?
A: Common warning signs include delayed renewals, unnoticed expirations, inconsistent revocation, slow onboarding for new users or devices, and poor visibility into certificate status. If teams rely on spreadsheets or disconnected processes, they often discover problems only after downtime or access failures occur. Those symptoms usually indicate the lifecycle process is too manual to scale safely.
Q: How should security teams govern IoT device certificates at scale?
A: Security teams should govern IoT device certificates with a single lifecycle process for issuance, renewal, revocation, and retirement. The practical test is whether every device identity is visible enough to be renewed before expiry and revoked when the device leaves service. If not, certificate management has become an uptime risk as well as a security risk.
Technical breakdown
Why certificate lifetimes and DCV reuse are tightening
Public SSL/TLS certificates now sit inside a policy model that assumes shorter trust windows and more frequent proof of domain control. Certificate lifetime governs how long the certificate remains valid after issuance, while DCV reuse defines how long a certificate authority can reuse the previous proof of domain ownership before requiring fresh validation. These are different control points in the lifecycle. As the intervals shrink, the risk of stale trust and unreviewed exposure drops, but the operational burden rises sharply for any environment still relying on manual renewals.
Practical implication: treat issuance, renewal, and domain validation as continuous machine identity controls rather than periodic admin tasks.
Why automation becomes the control that matters most
When certificates expire in 47-day windows, manual tracking becomes brittle because renewal, installation, validation, and revocation all need to happen repeatedly and predictably. Automation is not just a convenience layer here. It is the mechanism that reduces expiry risk, prevents service interruption, and keeps certificate state aligned with policy. In practice, automation must cover discovery, renewal triggers, and deployment across websites, APIs, internal systems, and non-browser clients, otherwise the certificate lifecycle remains fragmented even if one platform is automated.
Practical implication: automate certificate discovery and renewal before shortening lifetimes expose missed dependencies and unowned assets.
How shorter certificate lifetimes affect machine identity governance
Certificates are identity credentials for workloads, not just transport-layer artifacts. That means shorter lifetimes change governance expectations around inventory, ownership, and offboarding. If a certificate cannot be tracked back to a service owner, renewal and revocation become guesswork. The same applies to VPNs, IoT systems, internal applications, and legacy services that may not support modern automation. This is why the article’s operational advice points toward central policy, reporting, and lifecycle visibility rather than isolated certificate management.
Practical implication: map certificates to service owners and offboarding paths so expired or compromised machine identities do not linger.
Threat narrative
Attacker objective: The objective is to exploit stale certificate trust before renewal or revocation closes the window.
- Entry occurs when a certificate or its domain validation state remains trusted longer than it should, creating a wider exposure window for misuse.
- Credential abuse follows when a compromised certificate can still authenticate services or endpoints until expiry or revocation catches up.
- Impact occurs when stale certificate trust enables service impersonation, interrupted renewals, or failures in secure communications.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
47-day certificates turn certificate lifecycle into identity governance: the core issue is not simply shorter validity, but the collapse of any operating model that treats certificates as infrequent maintenance objects. Once renewal windows compress, inventory accuracy, ownership, and revocation discipline become the control plane. Organisations that still manage certificates as ad hoc infrastructure will find that trust now depends on machine identity governance.
Manual certificate handling becomes an availability risk before it becomes a compliance issue: the article is right to frame automation as the practical response, because missed renewal windows create outages before they create audit findings. That shifts the governance question from 'how do we renew certificates' to 'which certificates can the organisation prove it owns, automates, and monitors end to end?' Practitioners should treat this as a lifecycle integrity problem.
Certificate lifetimes now intersect with non-human identity controls: certificates are credentials for services, APIs, VPNs, and IoT systems, so this policy shift belongs in NHI governance conversations, not just PKI teams. The named concept here is machine identity renewal pressure, meaning the operational strain created when credential lifetimes are shorter than human-driven process cycles. Teams should design for that pressure explicitly.
Post-quantum readiness is an adjacent benefit, not the main driver: the article correctly notes that shorter certificate lifetimes support faster cryptographic change, but practitioners should not wait for PQC to justify action. The immediate value is tighter revocation windows, fresher validation, and better control over exposure. The practical conclusion is to modernise certificate governance now, because the policy change arrives on an operational timetable, not a theoretical one.
What this signals
Machine identity renewal pressure: shorter certificate lifetimes force security teams to align ownership, automation, and monitoring across every certificate-backed system. That pressure is strongest where certificates still sit outside central lifecycle governance, because those are the assets most likely to expire unnoticed.
The practical change for IAM and PAM teams is that certificate handling now needs the same discipline as privileged access: clear ownership, timely renewal, and visible revocation. Where that discipline is missing, the organisation will feel the impact as outages first and governance findings second.
For practitioners
- Map every certificate to an owner and service Build a current inventory that ties each public and internal certificate to a named service, team, and renewal path. Include browser-facing apps, APIs, VPNs, and legacy systems so no certificate sits outside a clear accountability chain.
- Automate renewal and deployment workflows Use ACME where it fits, but extend automation to renewal triggers, installation, validation, and rollback so expiry does not depend on a human calendar reminder. Prioritise the systems with the shortest renewal tolerance first.
- Set policy for DCV reuse and validation cadence Align governance rules to the shortened DCV reuse window so domain ownership checks are repeated on schedule and exceptions are explicit. Treat this as a policy issue, not a certificate-store detail.
- Add expiry telemetry to operational reporting Track certificate age, renewal success, and validation failures in central reporting so teams can spot drift before it turns into service disruption. Pair alerts with escalation paths that reach the actual certificate owner.
- Test non-browser client renewal paths Verify that VPNs, IoT devices, internal apps, and legacy systems can handle the same renewal pace as web certificates, or create compensating workflows where they cannot. Do not assume browser automation covers the rest of the estate.
Key takeaways
- Certificate policy changes are compressing the trust window around public SSL/TLS certificates, which makes lifecycle visibility a governance requirement rather than a technical preference.
- The risk is not only shorter validity. It is the mismatch between rapid renewal cycles and organisations that still manage certificates manually.
- Teams that already maintain inventory, ownership, and automation will absorb the shift more cleanly than teams that rely on spreadsheets and manual reminders.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Short-lived certificates reduce the exposure window created by long-lived credential material. |
| NHI-02 — Secret Leakage | Certificate material and validation state can be exposed or misused when lifecycle tracking is weak. | |
| Recommendation — Replace manual certificate renewals with automated lifecycle controls before expiry windows compress further. Scan certificate inventories and renewal pipelines for exposed credential material and revoke stale instances. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificates are authenticators whose issuance, renewal, and revocation need formal lifecycle control. |
| Recommendation — Enforce authenticator lifecycle policies for certificates, including renewal, replacement, and revocation timing. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Stale certificates extend the window in which compromised credentials can be abused. |
| Recommendation — Map certificate exposure to credential access risk and prioritise revocation paths for compromised assets. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate-backed trust is an authorization and authentication control that needs governed ownership. |
| Recommendation — Tie certificate ownership and renewal to access authorization processes so lifecycle drift is visible. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Domain Control Validation: Domain Control Validation is the process a certificate authority uses to confirm that a requester can control a domain before issuing a certificate. In practice, it is a governance checkpoint that ties certificate issuance to DNS authority, approval flow, and proof of control rather than to a person’s assertion.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Automated Certificate Renewal: Automated certificate renewal is a protocol driven method for renewing and installing certificates without relying on manual calendar reminders. It is used to reduce human error, especially where certificate volumes are high and lifetimes are short. Automation helps prevent expiry events from reaching production unnoticed.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity controls into lifecycle discipline across modern environments.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org