TL;DR: FY26 closed with the largest fourth-quarter ARR and more than 100% bookings attainment, while also expanding certificate lifecycle automation, DNS integration, and zero trust email security, according to DigiCert. The signal for practitioners is that trust infrastructure is now operational identity work, not just cryptography management.
At a glance
What this is: DigiCert’s FY26 update links record ARR growth with expanding certificate lifecycle automation, DNS integration, and email trust controls.
Why it matters: For IAM, NHI, and platform teams, this shows certificate management is becoming a governed identity lifecycle problem, not just a cryptography task.
By the numbers:
- DigiCert reported more than 100% attainment on topline bookings targets.
- DigiCert said its Forrester Total Economic Impact report showed a 312% return on investment over three years.
Context
Certificate lifecycle automation is the discipline of issuing, renewing, revoking, and tracking certificates and related trust assets in a controlled way. In this article, DigiCert ties that discipline to enterprise demand, showing that trust operations are now being treated as part of identity and infrastructure governance.
The practical issue is scale and shrinkage at the same time. As certificate lifespans shorten and environments spread across cloud, DNS, software delivery, and messaging, manual ownership models fail because no team can reliably track every renewal, dependency, and outage risk by hand.
Key questions
Q: How should federal teams govern certificate lifecycle automation in hybrid environments?
A: Federal teams should treat certificate lifecycle automation as a governance control, not just an operations upgrade. Start with ownership, dependency mapping, renewal policy, and audit reporting across every environment where certificates support identity or encryption. Automation should reduce manual error, but it must preserve oversight, logging, and revocation control.
Q: Why do shorter certificate lifespans force automation?
A: Shorter certificate lifespans compress the time available to issue, deploy, validate and revoke certificates. Human workflows cannot reliably keep pace when renewal cycles shrink, especially across distributed infrastructure. Automation becomes necessary because it reduces missed handoffs, keeps trust state current and limits the chance that expired certificates will break services or remain trusted beyond policy.
Q: What breaks when certificate management and DNS are handled separately?
A: Operational continuity breaks first. Certificate updates and DNS dependencies often change on different schedules, so separate ownership creates timing gaps, missed validation steps, and avoidable outages when the trust chain changes but adjacent records do not.
Q: How do organisations know whether privacy automation is actually improving governance?
A: Look for shorter request cycle times, fewer rework loops, consistent assessment outputs, and stronger audit trails. The key signal is whether the programme can show repeatable decisions with less manual chasing, while still preserving review quality and documented accountability.
Technical breakdown
Why certificate lifecycle management is becoming an operational control
Certificate lifecycle management is no longer just about keeping TLS working. It now covers issuance, validation, renewal, revocation, and visibility across multiple systems that depend on trusted machine-to-machine communication. Once certificate lifespans shorten, the control problem shifts from periodic administration to continuous governance, because missed renewals create outages, and unmanaged certificates create blind spots. When integrated with DNS and other infrastructure layers, the lifecycle becomes a trust fabric rather than a standalone admin task.
Practical implication: Treat certificate lifecycle management as a governed operational control with ownership, telemetry, and change oversight.
What PKI and DNS convergence changes for trust automation
PKI and DNS are usually managed as separate domains, but they are both part of how trust is established and validated online. Converging them reduces coordination gaps that can cause outages, especially when certificate updates and DNS-related dependencies move at different speeds. The technical value is not consolidation for its own sake. It is the ability to automate adjacent trust dependencies together so that renewal, validation, and service continuity can be managed as one operational flow instead of two disconnected queues.
Practical implication: Align certificate operations and DNS change control so renewal workflows do not fail because adjacent trust dependencies were missed.
Why crypto-agility and quantum-ready cryptography now sit in the same conversation
Crypto-agility means an organisation can change cryptographic algorithms or trust dependencies without redesigning the entire environment. That matters because certificate estates are becoming larger and more interconnected while cryptographic expectations are also changing. DigiCert’s reference to AI-accelerated validation and quantum-ready cryptography reflects this pressure: trust systems need to absorb change without breaking service continuity. The operational issue is not whether new algorithms arrive eventually, but whether the certificate and trust stack can adapt at the pace of infrastructure change.
Practical implication: Map cryptographic dependencies now so algorithm changes do not become a forced outage or a multi-quarter migration.
NHI Mgmt Group analysis
Certificate lifecycle is now identity governance for machines: the old boundary between PKI administration and IAM has collapsed. Certificates, DNS dependencies, and trust automation now control whether workloads, services, and messaging systems can authenticate at all. The practitioner implication is that certificate ownership, rotation, and renewal paths belong in the same governance conversation as other non-human identity controls.
Shorter certificate lifespans expose the failure of manual trust operations: the more frequently trust artefacts expire, the less viable spreadsheet-based or ticket-driven administration becomes. That does not just raise workload. It increases the chance that the organisation discovers an expired certificate only when a service fails. Practitioners should read this as a governance maturity issue, not a tooling preference.
Trust automation is becoming a resilience control, not a convenience feature: the article’s emphasis on unified lifecycle management, DNS integration, and scaling across environments shows where the market is heading. Organisations that still separate certificate handling from broader infrastructure governance will keep carrying avoidable outage and audit risk. The practical conclusion is to govern trust assets as production identities.
Trust opacity is the named risk emerging from fragmented certificate estates: when certificates, DNS, and platform dependencies are tracked in different places, no team has a complete view of what will break when a trust object changes. That opacity is now the governance problem. The implication is that lifecycle visibility must be treated as a control objective, not merely a reporting output.
Operational trust now spans human, machine, and platform layers: the same organisational pressure that pushed IAM toward lifecycle governance is now pulling certificate management into the same orbit. Once trust automation is embedded across cloud, software delivery, IoT, and messaging, the question is not whether certificates are secure in isolation. It is whether the enterprise can govern every trust dependency as part of one operating model. Practitioners should plan accordingly.
What this signals
Trust automation is moving into the same governance tier as IAM: certificate lifecycles now sit at the point where infrastructure reliability, service authentication, and operational ownership intersect. Teams should stop treating certificates as isolated security artefacts and start governing them as production trust dependencies.
Certificate lifespans are a forcing function for operating-model change: as renewal windows shrink, the control model must shift from periodic review to continuous ownership and telemetry. The organisations that adapt first will be the ones that can keep service continuity without adding manual overhead.
Trust opacity is the practical risk for most enterprise programmes: if a certificate, DNS dependency, or trust endpoint is invisible to the team responsible for it, the organisation cannot manage its failure mode. That makes inventory and dependency mapping prerequisites for resilience, not optional hygiene.
For practitioners
- Define certificate ownership and lifecycle accountability Assign explicit ownership for issuance, renewal, revocation, and dependency tracking so expired or orphaned certificates do not sit outside any governed workflow.
- Inventory trust dependencies across adjacent systems Map where certificates depend on DNS, application delivery, messaging, cloud platforms, and third-party services so one change does not break another control plane.
- Move renewal workflows toward event-driven automation Replace manual renewal reminders with policy-based automation, telemetry, and exception handling for high-volume certificate estates.
- Plan for cryptographic change before lifetimes shrink further Track where certificate standards, algorithm choices, and platform constraints could force coordinated migration so crypto-agility becomes a managed programme rather than an emergency.
Key takeaways
- Certificate lifecycle automation is becoming a governance issue because trust assets now affect service continuity, not just cryptographic administration.
- DigiCert links record fiscal performance with growing demand for automation, DNS integration, and resilience across shortening certificate lifespans.
- Practitioners should treat certificates as governed production identities and build ownership, visibility, and crypto-agility into the operating model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Shortening certificate lifespans make lifecycle control central to this article. |
| NHI-01 — Improper Offboarding | The article’s lifecycle focus maps to revocation and retirement of trust assets. | |
| Recommendation — Automate certificate renewal and revocation before trust artefacts outlive their intended window. Remove expired or unused certificates from service inventory and offboarding workflows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificates are authenticators whose lifecycle must be managed continuously. |
| Recommendation — Apply IA-5 to enforce certificate issuance, renewal, rotation, and revocation controls. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate-driven trust determines whether services are authorized to connect. |
| Recommendation — Review certificate-based trust paths as part of your authorisation governance. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | Expired or stolen trust artefacts can enable access loss and service disruption. |
| Recommendation — Map certificate failure modes to credential access and impact scenarios in detection planning. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Trust Automation: The use of policy, orchestration, and telemetry to manage trust assets automatically across systems. It becomes valuable when certificate volume, renewal frequency, and infrastructure complexity make manual handling too slow and too error-prone to support reliable operations.
- Certificate Dependency: Any service, DNS record, platform, or workflow that must align with a certificate for authentication or continuity to work. Dependency management matters because a certificate rarely fails alone; the operational risk often appears in the connected systems around it.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org