Topic starter
11/07/2026 8:28 pm
TL;DR: Certificate lifetimes are shortening from 398 days today to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029, according to GlobalSign. Manual renewal processes cannot keep pace, so certificate governance is shifting from periodic administration to continuous automation and crypto-agility.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Was wäre, wenn es keine Verschlüsselung gäbe?”.
By the numbers:
- Certificate lifetimes are falling from 398 days today to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029.
Key questions
Q: What breaks when certificate lifetimes shrink faster than teams can renew manually?
A: Manual certificate management breaks at the coordination layer first.
Q: Why do shorter SSL/TLS lifetimes create pressure for automation and crypto-agility?
A: Shorter lifetimes compress the time available to detect failures, renew certificates, and coordinate changes across dependent systems.
Q: What are the signs that certificate governance is failing in critical infrastructure?
A: Common warning signs include unclear ownership, expired certificates, mixed use of approved and unapproved issuers, and last-minute manual renewals.
Practitioner guidance
- Map every certificate to an accountable owner Build a complete inventory of certificates, expiration dates, and dependent systems so no certificate is renewed without a named owner and service dependency context.
- Automate renewal for short-lived certificates Replace spreadsheet and reminder-based renewals with automated issuance and replacement flows, starting with the certificates that support customer-facing and business-critical services.
- Adopt ACME where renewal is repetitive Use ACME to standardise issuance and renewal for environments that can support it, then extend the process with reporting and validation controls for enterprise-scale oversight.
Bottom line: Shorter certificate lifetimes expose a control gap that manual renewal processes cannot close reliably at enterprise scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:56 pm
Certificate lifetimes are now a lifecycle governance problem, not a renewal problem. Once certificate validity compresses into short windows, the real control question becomes whether the organisation can discover, own, and replace every certificate before it expires. That pushes certificate management into the same governance category as non-human identity lifecycle management, where manual review is too slow to protect the estate. Practitioners should treat expiry reduction as a forcing function for machine identity governance.
A question worth separating out:
Q: How should organisations govern certificates across websites, APIs, and IoT devices?
A: They should treat certificates as a managed identity estate with explicit ownership, automated renewal, and dependency mapping across every environment. That means no certificate should exist without a known service owner, a documented renewal path, and monitoring that can detect early expiry risk. The same governance discipline should extend to changes in cryptographic standards.
👉 Read our full editorial: Shorter certificate lifetimes are forcing PKI automation now