TL;DR: Certificate lifetimes are shortening from 398 days today to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029, according to GlobalSign. Manual renewal processes cannot keep pace, so certificate governance is shifting from periodic administration to continuous automation and crypto-agility.
At a glance
What this is: GlobalSign argues that shorter SSL/TLS certificate lifetimes are turning certificate management from periodic administration into continuous automation and crypto-agility planning.
Why it matters: This matters to IAM practitioners because certificates function as machine identities, and shrinking validity windows expose gaps in ownership, renewal, and lifecycle governance across APIs, websites, and internal systems.
By the numbers:
- Certificate lifetimes are falling from 398 days today to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029.
Context
SSL/TLS certificates are the machine identity layer that lets users, applications, and services trust each other over the network. When those certificates expire too quickly for manual processes to keep up, the issue stops being certificate housekeeping and becomes a governance problem across application, cloud, and identity operations.
The article shows why existing renewal models fail: teams that rely on spreadsheets, calendar reminders, and email prompts cannot manage a lifecycle that moves from annual renewal to near-continuous change. For identity and security programmes, this is the same control challenge seen in other NHI lifecycles, where ownership, rotation, and revocation must be automated to remain reliable.
The subject is typical of organisations still running certificate operations as a task, but the direction of travel makes that approach increasingly atypical and unsustainable.
Key questions
Q: What breaks when certificate lifetimes shrink faster than teams can renew manually?
A: Manual certificate management breaks at the coordination layer first. Inventory, ownership, approvals, deployment windows, exception handling, and audit evidence all have to move in lockstep, and spreadsheets cannot reliably drive that process. Once validity windows compress, the control problem becomes repeatability, not just visibility.
Q: Why do shorter SSL/TLS lifetimes create pressure for automation and crypto-agility?
A: Shorter lifetimes compress the time available to detect failures, renew certificates, and coordinate changes across dependent systems. Automation reduces the chance of expiry-driven outages, while crypto-agility ensures the environment can adapt when algorithms or trust requirements change. Together, they turn certificate handling into a continuous control rather than an occasional task.
Q: What are the signs that certificate governance is failing in critical infrastructure?
A: Common warning signs include unclear ownership, expired certificates, mixed use of approved and unapproved issuers, and last-minute manual renewals. If teams cannot produce a complete certificate inventory or evidence of renewal and revocation controls, governance is already weak. Those gaps usually surface as service disruption, audit friction, or insecure exceptions.
Q: How should organisations govern certificates across websites, APIs, and IoT devices?
A: They should treat certificates as a managed identity estate with explicit ownership, automated renewal, and dependency mapping across every environment. That means no certificate should exist without a known service owner, a documented renewal path, and monitoring that can detect early expiry risk. The same governance discipline should extend to changes in cryptographic standards.
Technical breakdown
Why shorter certificate lifetimes change the operating model
Certificate validity used to allow human-led renewal cycles, but shorter lifetimes compress the window in which errors can be detected and corrected. Once certificates move from hundreds of days to weeks, the lifecycle becomes operationally similar to secret rotation: issuance, deployment, validation, replacement, and retirement all need to happen with minimal manual touch. The practical issue is not just expiry. It is the dependency chain behind the certificate, including DNS, load balancers, APIs, mobile endpoints, and internal services that can break if renewal is late or incomplete.
Practical implication: Treat certificate lifecycle as an automated control plane, not as a periodic admin task.
Why manual renewal fails at scale
Manual certificate management depends on people noticing dates, coordinating across teams, and completing changes before expiry. That model fails when one organisation may own hundreds or thousands of certificates across cloud platforms, websites, IoT devices, and internal systems. The failure mode is predictable: certificates expire, services go down, and teams discover the gap only after users or auditors feel the impact. In governance terms, the problem is fragmented ownership. In identity terms, the problem is unmanaged machine identities with no reliable lifecycle enforcement.
Practical implication: Assign explicit ownership for every certificate and remove any renewal process that still depends on human memory.
How ACME and crypto-agility fit the transition
ACME standardises certificate issuance and renewal so that systems can request and replace certificates automatically. That solves the mechanics of renewal, but it does not by itself solve the broader lifecycle problem of inventory, monitoring, reporting, and change coordination. Crypto-agility goes one level deeper: it is the ability to change cryptographic algorithms and trust dependencies without redesigning the environment. That matters because shorter lifetimes are being paired with post-quantum readiness, so organisations need automation that can adapt as certificate policies and algorithms continue to change.
Practical implication: Use ACME for renewal automation, but pair it with inventory and reporting controls that support future cryptographic change.
Threat narrative
Attacker objective: The practical objective is not exploitation by an external attacker but failure of trusted communications through expired or unmanaged certificates.
- Entry occurs when certificate renewal is managed manually and an expiry date is missed in a large estate.
- Credential abuse follows when an expired certificate breaks trusted service communication and denies secure access to the dependent system.
- Impact is service outage, failed transactions, and loss of trust in the affected digital channel.
NHI Mgmt Group analysis
Certificate lifetimes are now a lifecycle governance problem, not a renewal problem. Once certificate validity compresses into short windows, the real control question becomes whether the organisation can discover, own, and replace every certificate before it expires. That pushes certificate management into the same governance category as non-human identity lifecycle management, where manual review is too slow to protect the estate. Practitioners should treat expiry reduction as a forcing function for machine identity governance.
Shorter lifetimes expose the weakness of spreadsheet-driven control. The article describes a model where teams still depend on calendars, email reminders, and ad hoc coordination. That works only when renewal happens occasionally. As lifetimes shorten, the control gap is not awareness but execution, and that gap is exactly where outages, audit findings, and trust failures emerge. Practitioners should measure whether renewal is deterministic or still dependent on human follow-up.
Crypto-agility is becoming a trust requirement, not a future architecture preference. The move toward post-quantum readiness means certificates must be replaceable without redesigning every dependent system. That makes automation, inventory, and policy enforcement part of the trust fabric rather than a back-office efficiency exercise. For security and identity teams, the strategic issue is whether cryptographic change can happen at machine speed when the standards shift.
ACME is useful, but ACME alone is not governance. Standardised issuance and renewal reduce friction, yet they do not solve ownership, dependency mapping, or evidence generation for compliance. Organisations that stop at automated renewal will still struggle with visibility across websites, APIs, IoT devices, and internal services. Practitioners should pair protocol automation with lifecycle controls that prove the estate is actually under management.
What this signals
Short-lived certificates turn PKI into a governance discipline. The practical shift is from periodic renewal to continuous lifecycle control across every service that depends on trust. That means inventory quality, ownership, and automation now matter as much as the certificate itself, because expiry risk propagates through application, cloud, and identity layers.
Machine identity governance is the adjacent control problem. Certificates are not just encryption artifacts, they are identity credentials for services, APIs, and devices. When validity windows shrink, organisations that already struggle with non-human identity ownership will feel the same weaknesses in certificate estates, especially where renewal, revocation, and replacement are still handled manually.
For practitioners
- Map every certificate to an accountable owner Build a complete inventory of certificates, expiration dates, and dependent systems so no certificate is renewed without a named owner and service dependency context.
- Automate renewal for short-lived certificates Replace spreadsheet and reminder-based renewals with automated issuance and replacement flows, starting with the certificates that support customer-facing and business-critical services.
- Adopt ACME where renewal is repetitive Use ACME to standardise issuance and renewal for environments that can support it, then extend the process with reporting and validation controls for enterprise-scale oversight.
- Build a crypto-agile migration plan Test whether your platform can swap algorithms and trust chains without redesigning services, because shorter lifetimes and post-quantum change will both demand faster certificate replacement.
Key takeaways
- Shorter certificate lifetimes expose a control gap that manual renewal processes cannot close reliably at enterprise scale.
- The operational risk is not only expired certificates, but broken service dependencies, failed transactions, and compliance findings.
- Automated renewal, accurate inventory, and crypto-agility are now part of baseline trust governance for digital services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Shorter certificate validity pushes certificate lifecycle control into the same risk area as long-lived machine credentials. |
| NHI-01 — Improper Offboarding | Expired or unmanaged certificates behave like unoffboarded machine credentials that remain trusted past their intended life. | |
| Recommendation — Replace manual renewal with automated lifecycle controls before certificate expiry becomes a recurring outage path. Track certificate retirement as part of identity offboarding so stale trust is removed on schedule. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate renewal and replacement map directly to authenticator lifecycle management. |
| Recommendation — Apply IA-5 to enforce automated rotation, renewal, and revocation for certificate-based authenticators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificates grant service access, so entitlement governance applies to certificate-based trust relationships. |
| Recommendation — Review certificate-based entitlements as access permissions and remove any trust path no longer needed. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certificate estates need the same ownership and lifecycle discipline as account management at scale. |
| Recommendation — Extend account management discipline to certificate inventories, ownership, and renewal workflows. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- ACME: ACME is a protocol used to automate certificate issuance and renewal between a client and a certificate authority. For practitioners, it reduces manual renewal work, but it also introduces a dependency on correct client configuration, credential handling, and monitoring of the automation path.
- Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity governance into controls that stand up across cloud, application, and platform estates.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org