TL;DR: The CA/Browser Forum’s phased move to 47-day TLS certificates turns machine identity management from a renewal task into an operational resilience problem, according to Thryam. Manual tracking, partial automation, and incomplete visibility cannot sustain the new cadence, which makes discovery, inventory, and end-to-end automation the real control plane.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Thryam's blog post: 47-day certificate validity makes incomplete visibility, manual renewal, and fragmented tooling operationally unsustainable.
Why it matters: It matters because certificate lifecycle control is now inseparable from broader NHI governance, including discovery, inventory, ownership, and automation across hybrid estates.
By the numbers:
- A team managing 1,000 certificates with each renewal taking 4 hours would grow from 2 people today to 16 by 2029.
- The CA/Browser Forum’s phased timeline reaches a maximum validity of 47 days by March 2029.
Context
Machine identity management is the governance problem behind certificates, SSH keys, and other cryptographic assets that systems use to authenticate and communicate. In this article, the 47-day TLS certificate timeline is the forcing function that reveals how much of that estate still depends on manual knowledge, partial automation, and fragmented ownership.
The primary issue is not simply shorter certificate validity. It is that discovery, inventory, renewal, and deployment are still treated as separate tasks in many enterprises, even though they operate as one lifecycle for machine identity. Once renewal windows compress, any unknown certificate, orphaned key, or undocumented dependency becomes a recurring outage risk.
That makes machine identity management a governance discipline, not a renewal task. The article’s position is that organisations need complete visibility and end-to-end automation before the deadline pressure lands, because the underlying control failure is already present today.
Key questions
Q: What breaks when 47-day certificate cycles meet partial automation?
A: Partial automation breaks because it only covers the certificates teams already know about. When renewal frequency rises and the estate is incomplete, hidden assets, orphaned keys, and undocumented dependencies become the main outage drivers, not the scheduled renewals themselves.
Q: Why do shorter certificate lifetimes create more risk for infrastructure teams?
A: Shorter lifetimes compress the time available to discover assets, confirm ownership, obtain approvals, and deploy replacements. That exposes weak governance, because manual methods can appear adequate at annual cadence but fail when the same process must run quarterly or monthly across many services and environments.
Q: What are the signs that machine identity governance is no longer keeping up?
A: Common signs include surprise certificate expirations, repeated manual renewals, inconsistent policy enforcement, and teams that cannot answer who owns a given key or trust anchor. If controls only produce occasional snapshots, the programme is already behind the pace of the environment.
Q: How should teams govern certificates and SSH keys as one lifecycle?
A: Treat them as parts of the same trust fabric rather than separate technical tasks. One inventory, one ownership model, and one lifecycle process reduce blind spots, align accountability, and make automation workable across hybrid infrastructure.
Technical breakdown
Why 47-day certificate cycles break renewal workflows
Certificate renewal has traditionally been managed as a periodic task, often with a human review loop around expiry monitoring and reissue. When maximum validity drops from a year to 47 days, the frequency of renewals multiplies, and the operating model changes from occasional maintenance to continuous lifecycle execution. That shift matters because the workload is not only more frequent, it is less forgiving of exceptions, undocumented assets, and delayed approvals. In practice, a renewal model that depends on staff noticing and acting before expiry cannot scale across thousands of certificates. The control problem is not the certificate itself, but the operating assumption that humans can keep pace with the cadence.
Practical implication: move renewal off manual tracking and into policy-driven lifecycle automation before expiry windows compress further.
Why visibility is the real control plane for machine identities
The article treats certificates, SSH keys, and cryptographic assets as a single machine identity fabric because they all represent credentials used by non-human systems. The technical issue is that many environments have incomplete inventories, with assets spread across cloud, on-premise, containers, and edge systems. Without discovery, teams cannot know what exists, who owns it, or whether it is still in use. That creates a blind spot where orphaned certificates, wildcard deployments, and forgotten SSH keys remain active long after their business purpose has changed. Inventory is therefore not a reporting exercise. It is the prerequisite for any meaningful renewal, rotation, or revocation control.
Practical implication: establish continuous discovery and authoritative inventory before attempting broader automation or consolidation.
How fragmented tooling creates blind spots in cryptographic governance
The article argues that separate tools for certificates, SSH keys, and cryptographic discovery create seams that hide risk. A certificate can be tracked in one system, deployed from another, and owned by nobody when the environment changes. SSH keys make the problem sharper because they often do not expire and are frequently shared or forgotten. From a governance standpoint, the failure mode is fragmentation: controls are present in pieces, but no single process spans discovery, ownership, monitoring, and enforcement. The result is not just inefficiency, but delayed remediation and weak accountability across the lifecycle.
Practical implication: align certificate, SSH key, and cryptographic asset governance under one lifecycle model rather than separate point tools.
Threat narrative
Attacker objective: The objective is to exploit unmanaged machine identities that still grant authentication or privileged access across enterprise systems.
- Entry occurs when undocumented certificates or orphaned SSH keys remain active because the estate was never fully discovered.
- Escalation follows when unknown credentials continue to authenticate privileged systems after ownership has been lost.
- Impact appears as outages, audit findings, and invisible attack surface growth when expired or untracked machine identities are discovered too late.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
47-day certificate cycles expose a machine identity governance gap, not just a renewal problem. The article is right to treat shorter validity as a forcing function because the real weakness is the operating model behind it. If renewal depends on humans noticing assets, finding owners, and coordinating deployment, the lifecycle is already too brittle for the new cadence. The practitioner implication is that machine identity governance must be treated as continuous infrastructure control.
Discovery is the control that fails first when certificate lifetimes compress. The article shows that semi-automation only works on assets teams already know about, which makes inventory completeness the decisive variable. Unknown certificates, undocumented wildcards, and abandoned SSH keys are not edge cases once the cadence shortens; they become the dominant source of operational failure. The practitioner implication is that visibility has to precede any credible automation strategy.
Machine identity management should be understood as one trust fabric, not three separate problems. Certificates, SSH keys, and cryptographic assets all represent non-human credentials that authenticate systems and protect communication. Managing them through separate teams and point tools creates gaps between discovery, ownership, and enforcement. The practitioner implication is to govern them through one lifecycle and one accountability model.
End-to-end automation is now a baseline control expectation, not an optimisation. The article’s staffing math shows why partial automation cannot absorb the future renewal load. But the deeper point is that automation without discovery merely accelerates incomplete processes. The practitioner implication is to automate the full path from inventory to deployment, with humans retaining policy oversight rather than execution.
Cryptographic inventory has become a resilience and readiness issue, not only a security hygiene issue. The article links machine identity visibility to compliance and post-quantum readiness, which reflects the broader shift in governance expectations. Organisations will need to answer what they have, where it lives, and whether it is ready for change. The practitioner implication is to treat cryptographic visibility as an enterprise control surface, not an annual audit task.
What this signals
Ephemeral trust debt: shorter certificate validity does not reduce governance burden by itself, because every unknown certificate and forgotten SSH key still requires discovery before it can be renewed, replaced, or revoked. The organisations that survive the transition will be the ones that treat inventory as a live control, not a periodic project.
Machine identity programmes should expect stronger pressure on ownership evidence, not just certificate automation. When renewal windows shrink, auditors and operations teams will both want proof that every credential has a clear owner, a current purpose, and a defined lifecycle.
For practitioners
- Build a complete machine identity inventory Map every certificate, SSH key, and related cryptographic asset across cloud, on-premise, container, and edge environments. Include ownership, expiry, deployment location, and system dependency so that no renewal is handled from partial knowledge.
- Automate the full certificate lifecycle Extend automation beyond renewal to discovery, monitoring, procurement, deployment, and revocation. Use policy to govern exceptions, but remove manual intervention from the routine path wherever the process is repeatable.
- Eliminate orphaned SSH keys and shared credentials Identify keys that outlived role changes, departures, or system decommissioning, then revoke them and assign ownership to a named service or team. Treat indefinite validity as a standing access risk, not a housekeeping issue.
- Unify certificate and cryptographic governance Stop managing certificates, SSH keys, and cryptographic assets as separate silos. Put them under one operating model so that inventory, accountability, and remediation follow the same lifecycle rules.
- Prepare reporting for shorter validity and audit questions Document how the organisation will show complete visibility into machine identities, demonstrate control ownership, and prove readiness for shorter certificate lifetimes and future cryptographic transitions.
Key takeaways
- The article frames 47-day certificates as a machine identity governance problem, because renewal speed now depends on visibility and ownership rather than scripting alone.
- Manual tracking and partial automation cannot absorb the future renewal cadence, especially when hidden certificates and SSH keys are already present in the environment.
- The practical response is to unify discovery, inventory, automation, and accountability across the full machine identity lifecycle.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | The article centres on shortening credential lifetimes and the risk of indefinite SSH key validity. |
| NHI-01 — Improper Offboarding | Orphaned SSH keys and abandoned certificates show offboarding failures for machine identities. | |
| Recommendation — Shorten credential lifetimes and remove any machine identity that still depends on indefinite validity. Revoke machine identities when systems or owners change and enforce offboarding checks. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate renewal and SSH key lifecycle both map to authenticator lifecycle control. |
| Recommendation — Apply authenticator management controls to inventory, rotate, and revoke machine credentials. | ||
| NIST CSF 2.0 | ID.AM-02 — Software, Platforms and Services Are Inventoried | The article argues that discovery and complete inventory are prerequisites to control. |
| Recommendation — Inventory every machine identity asset before attempting automation or lifecycle enforcement. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Orphaned keys and expired-but-active certificates create paths for credential abuse and spread. |
| Recommendation — Map unmanaged machine identities to credential access and lateral movement risk in detections. | ||
Key terms
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- SSH key sprawl: SSH key sprawl is the uncontrolled growth of key pairs across servers, users, and teams, usually without a reliable owner or expiry process. In practice, it creates hidden access paths that are difficult to audit, rotate, or revoke, which turns routine administration into an unmanaged security exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 25, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org