Notifications
Clear all
Topic starter
12/07/2026 12:19 pm
TL;DR: New S/MIME baseline requirements, a proposed 90-day SSL/TLS certificate validity model, and Mozilla’s plan to distrust older root certificates are pushing PKI teams toward faster renewal and stronger validation, according to GlobalSign. Manual spreadsheets and ad hoc tracking are increasingly mismatched to certificate lifecycle pressure, especially where identity assurance and trust chains affect email and web security.
NHIMG editorial — based on content published by GlobalSign: PKI market changes, S/MIME requirements, shorter certificate lifetimes, and root distrust plans
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when certificate lifetimes become too short for manual tracking?
A: Manual tracking breaks first, then ownership, then renewal timing.
Q: Why do certificates need stronger identity validation for email security?
A: Certificates only deliver assurance if the issuer can prove who controls the mailbox or organisation represented in the certificate.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements.
Practitioner guidance
- Automate certificate discovery and renewal Replace spreadsheet tracking with continuous discovery, expiration monitoring, and automated renewal workflows for S/MIME and TLS certificates.
- Map certificate trust chains to root policy age Identify which certificates chain to legacy roots and which systems still trust those hierarchies.
- Align S/MIME issuance to identity assurance level Use different validation controls for mailbox, organisation, sponsor, and individual certificates instead of one generic approval path.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- A closer breakdown of the S/MIME validation categories and what each requires in practice.
- The policy timeline for 90-day certificate validity and how it could affect renewal planning.
- Mozilla's root distrust schedule and the implications for legacy trust-chain remediation.
- The article's automation angle for teams still managing certificates manually.
👉 Read GlobalSign's analysis of PKI policy changes and certificate lifecycle pressure →
Certificate lifecycle pressure is rising. Are manual controls keeping up?
Explore further
12/07/2026 12:33 pm
Certificate lifecycle control is now a governance issue, not an admin task. The article shows that policy shifts in PKI are tightening the margin for manual operations. When issuance, renewal, and trust-chain maintenance are still spreadsheet-driven, the problem is not just inefficiency, it is an identity assurance gap. Practitioners should treat certificate lifecycle as part of access governance, especially where certificates authenticate users, services, or email.
A question worth separating out:
Q: Who is accountable when certificate policy changes disrupt communications?
A: Accountability sits with the teams that own certificate inventory, identity assurance, and service continuity, usually across infrastructure, IAM, and security operations. If policy changes are going to break email or web trust, someone must own the root inventory, renewal process, and exception handling before disruption occurs.
👉 Read our full editorial: PKI policy changes expose the limits of manual certificate management
