Topic starter
12/07/2026 12:20 pm
TL;DR: Certificate lifetimes are being shortened to 47 days from 2029, and Cybertrust Japan shows how ACME-based automation can reduce renewal overhead while exposing dependencies on platform integration, scheduling, and certificate lifecycle operations. The governance shift is bigger than renewal tooling: identity and trust teams now need continuous certificate management, not periodic maintenance.
Editorial analysis by NHI Mgmt Group, based on content published by Cybertrust Japan: “ãSureHandsOn ACME à BIG-IP KOJOT-ACMEãKOJOT-ACME ã§å®ç¾ãããµã¼ãã¼è¨¼ææ¸ã®èªåæ´æ°”.
By the numbers:
- SSL/TLS server certificate validity will be shortened from 398 days to 47 days by 2029 under the CA/Browser Forum decision cited by Cybertrust Japan.
- The current 398 days will be shortened in stages beginning on 2026-03-15, with the minimum reaching 47 days.
- A theoretical 100 certificates a year becomes 400 renewals a year when validity drops from 1 year to 100 days.
Key questions
Q: What breaks when certificate lifetimes shrink faster than teams can renew manually?
A: Manual certificate management breaks at the coordination layer first.
Q: Why do short-lived TLS certificates increase operational risk?
A: Short-lived TLS certificates increase operational risk because every renewal creates another chance for delay, misconfiguration, or missed deployment.
Q: How do teams know whether certificate automation is actually working?
A: Look for fewer human-mediated renewals, cleaner ownership records, lower expiry-driven outage rates, and reliable reporting across hybrid systems.
Practitioner guidance
- Inventory every certificate as a managed machine identity Map each TLS certificate to an owner, runtime location, renewal path, and dependency chain so expiry risk can be governed centrally.
- Automate the full request-to-deployment path Verify that renewal is not only issued through ACME but also applied to the final runtime target without manual transfer or scheduling gaps.
- Track renewal windows against shortened validity periods Align calendars, alerts, and change windows to the new certificate lifetime so a renewal miss cannot become an outage.
Bottom line: Shorter TLS lifetimes turn certificate handling into a continuous governance task rather than a periodic admin activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:33 pm
Shorter certificate lifetimes are not just a PKI change, they are a machine-identity governance change. The article shows that renewal volume rises as validity shrinks, which means the control problem becomes continuous lifecycle management. That is the same governance pattern NHIs expose elsewhere: the credential is the asset, and expiry failure is an operational security event, not a clerical issue. Practitioners should treat certificate lifecycle as a governed identity process.
A question worth separating out:
Q: What should organisations do when certificate management spans multiple platforms and appliances?
A: Assign ownership for each certificate path, validate how each platform consumes renewed certificates, and standardise the deployment step as part of the renewal workflow. If the last mile is still manual, the automation is incomplete.
👉 Read our full editorial: ACME-based certificate automation and shrinking TLS lifetimes