Topic starter
12/07/2026 12:20 pm
TL;DR: 47-day lifetimes show why certificate handling is becoming continuous, from Cybertrust Japan's case work. Certificate governance now has to cover issuance, scheduling, and deployment together, or expiry risk shifts to the last mile.
Editorial analysis by NHI Mgmt Group, based on content published by Cybertrust Japan: “ãSureHandsOn ACME à BIG-IP KOJOT-ACMEãKOJOT-ACME ã§å®ç¾ãããµã¼ãã¼è¨¼ææ¸ã®èªåæ´æ°”.
By the numbers:
- SSL/TLS server certificate validity will be shortened from 398 days to 47 days by 2029 under the CA/Browser Forum decision cited by Cybertrust Japan.
- The current 398 days will be shortened in stages beginning on 2026-03-15, with the minimum reaching 47 days.
- A theoretical 100 certificates a year becomes 400 renewals a year when validity drops from 1 year to 100 days.
Key questions
Q: Why do short-lived TLS certificates increase operational risk?
A: Short-lived TLS certificates increase operational risk because every renewal creates another chance for delay, misconfiguration, or missed deployment.
Q: How do teams know whether certificate automation is actually working?
A: Look for fewer human-mediated renewals, cleaner ownership records, lower expiry-driven outage rates, and reliable reporting across hybrid systems.
Q: What breaks when certificate lifetimes shrink faster than teams can renew manually?
A: Manual certificate management breaks at the coordination layer first.
Practitioner guidance
- Inventory every certificate as a managed machine identity Map each TLS certificate to an owner, runtime location, renewal path, and dependency chain so expiry risk can be governed centrally.
- Automate the full request-to-deployment path Verify that renewal is not only issued through ACME but also applied to the final runtime target without manual transfer or scheduling gaps.
- Track renewal windows against shortened validity periods Align calendars, alerts, and change windows to the new certificate lifetime so a renewal miss cannot become an outage.
Bottom line: Shorter TLS lifetimes turn certificate handling into a continuous governance task rather than a periodic admin activity.
Glossary terms: ACME, TLS certificate lifecycle, Machine Identity, Certificate Automation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/07/2026 12:33 pm
Shorter certificate lifetimes are not just a PKI change, they are a machine-identity governance change. The article shows that renewal volume rises as validity shrinks, which means the control problem becomes continuous lifecycle management. That is the same governance pattern NHIs expose elsewhere: the credential is the asset, and expiry failure is an operational security event, not a clerical issue. Practitioners should treat certificate lifecycle as a governed identity process.
A question worth separating out:
Q: What should organisations do when certificate management spans multiple platforms and appliances?
A: Assign ownership for each certificate path, validate how each platform consumes renewed certificates, and standardise the deployment step as part of the renewal workflow. If the last mile is still manual, the automation is incomplete.
👉 Read our full editorial: ACME-based certificate automation and shrinking TLS lifetimes