Expired and mismanaged certificates still take down services at most large organisations every year, and the move to 47-day public TLS certificates will multiply the number of renewals that can go wrong. This page collects certificate outage and public key infrastructure (PKI) figures that we could trace to their publishers: the CA/Browser Forum ballot that sets the new validity schedule, browser and certificate authority announcements, and vendor surveys from Keyfactor and DigiCert. Almost all outage figures come from vendor-commissioned surveys, so each row names the survey, its sample and its date, and we label them as single-vendor research. It is written for PKI owners, platform and SRE teams, and security leaders building the case for certificate automation. Last reviewed: November 2026.
Key takeaways
- Outages are routine, not rare. In Keyfactor's September 2025 survey of 450 practitioners, 86% had at least one certificate-related outage in the past year and 10% had one every week.
- The renewal workload is about to grow sharply. CA/Browser Forum Ballot SC-081 cuts maximum public TLS validity from 398 days to 200 days on 15 March 2026, 100 days on 15 March 2027 and 47 days on 15 March 2029.
- Visibility is the gap. Only 17% of Keyfactor's 2025 respondents had complete, real-time visibility across all certificates.
- Outages are expensive and slow. In DigiCert's 2026 Certificate Management Outlook, nearly one in four organisations said their worst certificate incident cost more than $250,000 and one in five had 25 hours or more of certificate-related downtime.
- Trust can be withdrawn at ecosystem scale. Chrome stopped trusting new certificates from nine Entrust and AffirmTrust roots issued after 11 November 2024, and Let's Encrypt switched off OCSP on 6 August 2025.
Headline statistics
| Statistic | Figure | Source and as-of date |
|---|---|---|
| Organisations with at least one certificate-related outage in the past year | 86% | Keyfactor, Digital Trust Digest: The Automation Edition, 30 September 2025 (Wakefield Research, 450 practitioners) |
| Organisations with certificate outages at least quarterly / weekly | 31% / 10% | Keyfactor, September 2025 |
| Organisations with complete, real-time certificate visibility | 17% | Keyfactor, September 2025 |
| Service outage caused by an expired certificate in the past year | More than one third | DigiCert, Certificate Management Outlook, 9 September 2026 (Propeller Insights, 1,001 respondents, May 2026) |
| Worst certificate incident cost more than $250,000 | Nearly one in four | DigiCert, September 2026 |
| Organisations managing more than 1,000 certificates | More than half | DigiCert, September 2026 |
| Maximum public TLS certificate validity from 15 March 2029 | 47 days | CA/Browser Forum Ballot SC-081v3; DigiCert schedule summary |
| Peak OCSP requests to Let's Encrypt before shutdown | About 340 billion per month | Let's Encrypt, 6 August 2025 |
Statistics by theme
The validity reduction schedule
Ballot SC-081v3 passed in the CA/Browser Forum in April 2025 with 25 certificate issuers voting yes, none against and five abstaining, and all four certificate consumers (Apple, Google, Microsoft and Mozilla) voting yes. It changes the Baseline Requirements as follows.
| Effective date | Maximum TLS certificate validity | Maximum domain or IP validation reuse | Maximum subject identity information reuse (OV/EV) |
|---|---|---|---|
| Before 15 March 2026 | 398 days | 398 days | 825 days |
| 15 March 2026 | 200 days | 200 days | 398 days |
| 15 March 2027 | 100 days | 100 days | 398 days |
| 15 March 2029 | 47 days | 10 days | 398 days |
Sources: CA/Browser Forum ballot page (endpoints and votes) and DigiCert's schedule summary (dated steps). DigiCert estimates that an enterprise with 1,000 public TLS certificates could face roughly 8,000 issuances and 40,000 domain validations a year under the final limits. The schedule applies to publicly trusted TLS certificates only; private PKI and internal certificates are set by your own policy. See the Certificate Expiry Outages and 47-Day TLS Certificates Guide.
Outage frequency and impact
| Finding | Figure | Survey |
|---|---|---|
| Service downtime from certificate-related incidents in the past year | 45% | DigiCert Trust Pulse Survey, 2 July 2025 (sample not stated) |
| Outages attributed specifically to expired certificates | 37.5% | DigiCert, July 2025 |
| Losses of $50,000 to $250,000 / more than $250,000 | 31% / 18.5% | DigiCert, July 2025 |
| At least five hours of certificate-related downtime | Nearly three quarters | DigiCert, September 2026 |
| 25 hours or more of certificate-related downtime | One in five | DigiCert, September 2026 |
| Service downtime due to certificate mismanagement | 40% | DigiCert, September 2026 |
| Average time to identify / remediate a certificate outage | 2.6 hours / 2.7 hours | Keyfactor, 2024 PKI and Digital Trust Report |
| Average staff needed to remediate an outage | Eight | Keyfactor, 2024 |
Read the ranges carefully. Keyfactor's 86% counts any certificate-related outage among large organisations; DigiCert's "more than one third" counts outages caused specifically by expiry across a broader sample. Both are plausible at once, and neither is a measure of how often your organisation will fail.
Volume, visibility and automation
- Volume: 91% of respondents in Keyfactor's 2024 PKI and Digital Trust Report said they were deploying more certificates than ever, up from 74% in 2023 and 61% in 2021. Nearly 60% of DigiCert's July 2025 respondents managed 1,000 to 10,000 certificates.
- Tooling: 32% of Keyfactor's 2024 respondents used a dedicated certificate lifecycle management tool.
- Automation progress: in Keyfactor's 2025 survey, 53% had automated at least part of the lifecycle and 46% had automated renewals, but 40% reported only partial success and 7% said their efforts had failed.
- Barriers: Keyfactor 2025 respondents named limited internal expertise (45%), competing priorities (39%), access control or approval concerns (39%) and integration challenges (38%). In DigiCert's 2026 survey, incompatibility with legacy systems (25%) and budget (21%) led, and only 10% said automation was already in place.
- Readiness for shorter lifetimes: 30% of DigiCert's 2026 respondents were not actively preparing. Active preparation was 74% in the US, 71% in the UK and 62% in Australia.
Ecosystem events that changed the numbers
| Event | Date | Scale | Source |
|---|---|---|---|
| Ericsson SGSN-MME software certificate expired, disrupting O2 (UK) and SoftBank (Japan) mobile data | 6 December 2018 | "Millions" of subscribers; UK MVNOs on O2 also affected | Computer Weekly |
| Chrome distrust of new Entrust and AffirmTrust certificates | Certificates with earliest SCT after 11 November 2024, Chrome 131 and later | Nine roots (five Entrust, four AffirmTrust); cited a six-year pattern of compliance failures | Google Security Blog |
| Let's Encrypt OCSP URLs removed from new certificates | 7 May 2025 | All new Let's Encrypt certificates rely on CRLs | Let's Encrypt |
| Let's Encrypt OCSP responders switched off | 6 August 2025 | About 340 billion requests per month at peak; more than 140,000 requests per second at the CDN | Let's Encrypt |
The Entrust case is the clearest evidence that mass replacement is a realistic scenario: every organisation using those roots for public TLS had to move to another CA on a browser's timetable. See the CA Compromise and Mass Certificate Replacement Playbook and the Certificate Revocation Guide.
What the numbers mean for defenders
- Inventory before you automate: with only 17% reporting full visibility, most outages start with a certificate nobody knew about. Combine CT log monitoring, network scanning and CA account exports into one register. Use the Certificate Inventory Register Template and see the Certificate Transparency Monitoring Guide for Web Teams.
- Automate renewal and deployment, not just issuance: the 40% partial-success figure reflects automation that renews a certificate but never installs it on the load balancer or appliance. ACME (RFC 8555) clients with deployment hooks close that gap. See the ACME and Automated Certificate Management Guide.
- Target 100-day readiness now: manual renewal at 200 days is painful but possible; at 100 days from March 2027 it is not for estates above a few hundred certificates.
- Plan for domain validation at 10 days: from 2029 the validation reuse window shrinks faster than certificate lifetime, so DNS-based validation must be automated through an API with scoped credentials.
- Rehearse CA replacement: keep at least two approved CAs contracted and test switching one service between them.
Which certificates the statistics cover
Outage surveys rarely separate certificate types, yet the rules and the failure modes differ. Use this table to decide which figures apply to which part of your estate.
| Certificate type | Validity set by | Affected by SC-081 | Typical outage cause |
|---|---|---|---|
| Public TLS (websites, public APIs) | CA/Browser Forum Baseline Requirements | Yes | Manual renewal missed, renewed certificate not deployed to every endpoint |
| Private TLS and mTLS (internal services, service mesh) | Your internal CA policy | No | Unknown issuing CA, hard-coded certificates in appliances |
| Code signing | CA/Browser Forum code signing requirements and your policy | No | Expired timestamping or signing certificate breaking builds and installers |
| Device and IoT certificates | Manufacturer or internal CA policy | No | Long-lived certificates that cannot be renewed in the field |
| Embedded software certificates | The software vendor | No | Vendor-shipped certificate expiring inside a product, as in the Ericsson 2018 case |
Using the numbers by organisation size
- Small organisations (tens of public certificates): the outage surveys over-represent large estates. The decisive fact for you is the schedule: a managed ACME client or a hosting provider that renews automatically removes most risk at low cost.
- Mid-sized organisations (hundreds of certificates): DigiCert's estimate of about eight issuances per public certificate per year under the 2029 limits is the planning figure. Manual tracking in spreadsheets stops being viable around the 100-day milestone.
- Large enterprises (thousands of certificates, several CAs): the Keyfactor and DigiCert figures describe your peers. Budget for discovery, a lifecycle platform, integration with load balancers and appliances, and a second CA contract. The eight-person, 2.7-hour average remediation effort is the cost of each failure you do not prevent.
When presenting to a board, pair one prevalence figure (for example Keyfactor's 86%) with the schedule table and your own inventory count. That combination shows both the likelihood and the scale of the change without leaning on a single vendor statistic.
Where identity fits
Every TLS, mTLS and code signing certificate is a machine identity with a private key that can be stolen, misused or left to expire. The credentials that automate certificates, such as ACME account keys, DNS provider API tokens and CA portal service accounts, are themselves non-human identities that need an owner, scope and rotation. Stolen signing material has caused real breaches: the Microsoft Storm-0558 Key Breach 2023 shows a stolen signing key used to forge access tokens. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Framework mapping
| Statistic area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | MITRE ATT&CK |
|---|---|---|---|
| Certificate visibility and inventory | ID.AM-02 (software, services and systems inventoried) | CM-8 System Component Inventory; SC-17 Public Key Infrastructure Certificates | Not applicable |
| Key and certificate lifecycle | PR.AA-03 (users, services and hardware authenticated) | SC-12 Cryptographic Key Establishment and Management; IA-5 Authenticator Management | T1588.004 Digital Certificates |
| Rogue trust anchors | DE.CM-09 (computing environments monitored) | SI-4 System Monitoring | T1553.004 Install Root Certificate |
| CA distrust and supplier changes | GV.SC-07 (supplier risk understood and monitored) | SA-9 External System Services | Not applicable |
Common failure patterns when using PKI statistics
- Comparing surveys as if they were one series: Keyfactor and DigiCert ask different questions of different samples. Compare one publisher's figures year on year only.
- Quoting vendor survey results as industry fact: every outage figure on this page comes from a vendor that sells certificate management. Say so when you cite it.
- Using numbers without a definition of "outage": some surveys include failed audits and security incidents in "certificate incidents". Quote the exact wording.
- Applying the 47-day rule to private PKI: SC-081 governs publicly trusted TLS certificates; internal CA policy is your decision, though shorter lifetimes are still good practice.
- Treating OCSP as still available: some monitoring and compliance checklists still require OCSP stapling. With Let's Encrypt's responders off since August 2025, update them to CRL-based checks.
Methodology notes and caveats
| Source | What it measures | Main caveat |
|---|---|---|
| CA/Browser Forum Ballot SC-081v3 | Rules for publicly trusted TLS certificates | Authoritative but can be amended by later ballots; recheck before each milestone |
| Keyfactor Digital Trust Digest 2025 | 450 PKI practitioners at firms with 1,000+ employees in North America and Europe | Vendor-commissioned; question wording not published in the release |
| Keyfactor 2024 PKI and Digital Trust Report | Practitioner survey on PKI operations | Vendor-commissioned; sample not stated on the summary page, and its incident counts are reported inconsistently, so we omit them |
| DigiCert Certificate Management Outlook 2026 | 1,001 IT and security decision makers in the US, UK and Australia, May 2026 | Vendor-commissioned; many figures given as "nearly" or "more than" |
| DigiCert Trust Pulse Survey 2025 | Certificate incidents and losses | Sample size not stated in the release |
| Browser and CA announcements | Dates and scope of trust changes | Primary and precise, but not statistics about prevalence |
Metrics to track in your own programme
- Inventory coverage: share of certificates found by discovery that are in the register with an owner.
- Automated renewal and deployment: share of public TLS certificates renewed and installed without human action.
- Expiry incidents: number of outages caused by expired certificates per quarter (target zero).
- Lead time: share of certificates renewed at least one third of their lifetime before expiry.
- CA agility: time taken to move a critical service to a second CA in the last test.
- Validation automation: share of domains with API-driven DNS validation ready for 10-day reuse.
Practitioner checklist
- Cite every certificate statistic with the publisher, survey name, sample and date, and label vendor research.
- Build one certificate inventory from CT logs, network scans and CA exports, with an owner per certificate.
- Automate renewal and deployment end to end for public TLS before the 100-day limit on 15 March 2027.
- Automate DNS-based domain validation with scoped API credentials ahead of 10-day reuse in 2029.
- Contract at least two CAs and test switching between them.
- Replace OCSP-dependent checks with CRL-based checks where your CA has dropped OCSP.
- Treat ACME account keys and DNS API tokens as privileged non-human identities.
- Alert on certificates expiring within 30 days and on unexpected certificates in CT logs.
- Recheck the CA/Browser Forum schedule before each milestone date.
Standards and references
- CA/Browser Forum: Ballot SC081v3, Introduce Schedule of Reducing Validity and Data Reuse Periods
- Google Security Blog: Sustaining Digital Certificate Security, Entrust Certificate Distrust
- Let's Encrypt: Ending OCSP Support in 2025
- Let's Encrypt: OCSP Service Has Reached End of Life
- Keyfactor: Digital Certificate Outages a Weekly Reality for 1 in 10 Enterprises
- Keyfactor: Key Takeaways from the 2024 PKI and Digital Trust Report
- DigiCert: Certificate Failures Are a Six-Figure Infrastructure Risk
- DigiCert: TLS Certificate Lifetimes Will Officially Reduce to 47 Days
Related NHI Mgmt Group resources: Expired Certificate Outage Troubleshooting Guide · Certificate Management Policy Template · Enterprise PKI Design and CA Hierarchy Guide · Non-Human Identity and Secrets Statistics Guide · Post-Quantum Readiness Statistics