Topic starter
11/07/2026 8:25 pm
TL;DR: Frequent SSL/TLS certificate renewal is exposing manual dependencies and weak ownership, according to GlobalSign. PKI governance has to absorb more rotation and change control if shorter lifetimes are to stay routine rather than disruptive.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Los certificados SSL/TLS de corta duración para prepararse para la criptografía post-cuántica”.
By the numbers:
- The CA/Browser Forum voted in April 2025 to reduce certificate validity to 47 days by 2029.
Key questions
Q: Why does shorter SSL/TLS certificate validity reduce security risk for digital trust systems?
A: Shorter validity reduces the window in which a stolen or compromised private key can be abused.
Q: What breaks when certificate renewal is still handled through manual workflows?
A: Manual renewal workflows break first at scale because they cannot keep pace with recurring expiry windows and cross team dependencies.
Q: How should teams govern certificates as part of machine identity management?
A: Treat certificates as machine identities with owners, lifecycle states, and policy controls.
Practitioner guidance
- Automate certificate issuance and renewal Replace manual renewal tickets with an automated lifecycle workflow that tracks issuance, expiry, replacement, and validation across all environments.
- Inventory all machine certificates and owners Maintain a current register of TLS certificates, private key custody, application owners, and renewal dependencies so no trust asset is unmanaged.
- Test algorithm agility before PQC migration Run staged exercises that replace certificates and trust chains under controlled conditions so future algorithm swaps do not become emergency projects.
Bottom line: Shorter certificate lifetimes are best understood as an operational control that exposes weak ownership, stale trust, and manual renewal dependencies.
Glossary terms: Cryptographic agility, Certificate Lifecycle Management, Post-Quantum Cryptography, Machine Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 52 minutes ago by NHI Mgmt Group
11/07/2026 8:55 pm
Short-lived certificates are really a machine identity control, not just a PKI housekeeping change. When certificates are treated as credentials, the governance question shifts from renewal convenience to trust lifespan and ownership. That matters because machine identities fail in the same way human accounts do when lifecycle controls lag behind reality. Practitioners should read 47-day validity as a signal that certificate governance now belongs in identity operations, not only in infrastructure operations.
A question worth separating out:
A: Start with the links that carry long-lived sensitive data and high-value administrative traffic, then use hybrid cryptography where classical and post-quantum methods can coexist. This lets teams gain quantum-safe exposure reduction while preserving compatibility. The key is to treat PQC as a staged architecture change, not a single cutover event.
👉 Read our full editorial: Certificate lifetimes, cripto-agility, and the PQC transition