Topic starter
12/07/2026 12:19 pm
TL;DR: New S/MIME baseline requirements, a proposed 90-day SSL/TLS certificate validity model, and Mozilla’s plan to distrust older root certificates are pushing PKI teams toward faster renewal and stronger validation, according to GlobalSign. Manual spreadsheets and ad hoc tracking are increasingly mismatched to certificate lifecycle pressure, especially where identity assurance and trust chains affect email and web security.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Cambios importantes para TI en PKI I GlobalSign”.
Key questions
Q: How should teams manage certificate renewals when lifecycles keep shrinking?
A: Teams should move from calendar-based renewal to continuous lifecycle orchestration.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: What breaks when SSL certificates are managed with spreadsheets instead of inventory control?
A: Spreadsheets fail because they do not create a live source of truth for ownership, expiry, placement or exceptions.
Practitioner guidance
- Automate certificate inventory and renewal tracking Replace spreadsheet-led tracking with a governed inventory that records owner, expiry, issuing CA, and renewal path for every certificate.
- Tie S/MIME issuance to stronger identity validation Require mailbox, organisation, sponsor, or individual validation to map cleanly to issuance policy so certificate identity matches the asserted email identity.
- Map root dependencies across the trust chain Identify which services, applications, and email flows depend on older root certificates so trust-policy changes can be assessed before they land.
Bottom line: Certificate lifecycle governance is becoming a continuous operational control problem as certificate policies and trust expectations tighten.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:33 pm
Manual certificate governance is now a control weakness, not just an efficiency issue. When certificate validity shrinks and root trust policies change, spreadsheets and ad hoc reminders become an unreliable governance model. The real failure mode is not effort, but latency between policy change, inventory awareness, and renewal action. Practitioners should treat this as a lifecycle control problem that spans IAM, PKI, and operational resilience.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What is the difference between renewal and re-issuance in certificate governance?
A: Renewal extends or replaces a certificate as it approaches expiry, while re-issuance is needed when the key pair, CA hierarchy or cryptographic algorithm changes. Re-issuance requires a fresh CSR because the public key binding and policy inputs have changed.
👉 Read our full editorial: PKI policy changes expose the limits of manual certificate management