Topic starter
11/07/2026 8:25 pm
TL;DR: Shorter SSL/TLS certificate lifetimes are being positioned as a way to reduce compromise windows and force automation ahead of post-quantum cryptography, according to GlobalSign. The real issue is not the calendar change itself but whether PKI, rotation, and change-management processes can absorb frequent replacement without disruption.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Los certificados SSL/TLS de corta duración para prepararse para la criptografía post-cuántica”.
By the numbers:
- The CA/Browser Forum voted in April 2025 to reduce certificate validity to 47 days by 2029.
Key questions
Q: How should teams govern certificates as part of machine identity management?
A: Treat certificates as machine identities with owners, lifecycle states, and policy controls.
Q: Why does shorter SSL/TLS certificate validity reduce security risk for digital trust systems?
A: Shorter validity reduces the window in which a stolen or compromised private key can be abused.
Q: What breaks when certificate renewal is still handled through manual workflows?
A: Manual renewal workflows break first at scale because they cannot keep pace with recurring expiry windows and cross team dependencies.
Practitioner guidance
- Automate certificate issuance and renewal Replace manual renewal tickets with an automated lifecycle workflow that tracks issuance, expiry, replacement, and validation across all environments.
- Inventory all machine certificates and owners Maintain a current register of TLS certificates, private key custody, application owners, and renewal dependencies so no trust asset is unmanaged.
- Test algorithm agility before PQC migration Run staged exercises that replace certificates and trust chains under controlled conditions so future algorithm swaps do not become emergency projects.
Bottom line: Shorter certificate lifetimes are best understood as an operational control that exposes weak ownership, stale trust, and manual renewal dependencies.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:55 pm
Short-lived certificates are really a machine identity control, not just a PKI housekeeping change. When certificates are treated as credentials, the governance question shifts from renewal convenience to trust lifespan and ownership. That matters because machine identities fail in the same way human accounts do when lifecycle controls lag behind reality. Practitioners should read 47-day validity as a signal that certificate governance now belongs in identity operations, not only in infrastructure operations.
A question worth separating out:
A: Start with the links that carry long-lived sensitive data and high-value administrative traffic, then use hybrid cryptography where classical and post-quantum methods can coexist. This lets teams gain quantum-safe exposure reduction while preserving compatibility. The key is to treat PQC as a staged architecture change, not a single cutover event.
👉 Read our full editorial: Certificate lifetimes, cripto-agility, and the PQC transition