Topic starter
24/10/2026 8:53 pm
TL;DR: TLS certificate lifetimes are shrinking from 100 days toward 47 days by 2029, while domain validation reuse windows may fall to 7 hours and post-quantum migration will add more pressure, according to Red Sift. Manual renewal will not scale, and continuous issuance monitoring becomes the practical control.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Let's Encrypt webinar recap: Adapting to shorter certificate lifecycles and PKI changes”.
Key questions
Q: What breaks when certificate renewals still depend on manual approval?
A: Manual approval breaks when the renewal window is shorter than the time needed to notice, review, and act.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: What are the signs that certificate automation is not working well enough?
A: Common warning signs include fragmented visibility across certificate authorities, reliance on spreadsheets or homegrown trackers, missed expirations, and certificates that remain outside a central inventory.
Practitioner guidance
- Automate certificate issuance and renewal Use ACME for every service where supported, and treat renewal as part of the service lifecycle rather than a periodic admin task.
- Monitor the full renewal path Track issuance success, renewal success, distribution, and service reload as separate observable steps so failures are visible before expiry.
- Map and verify complete certificate inventory Include public, private, internal, SaaS-embedded, decommissioned, and third-party certificates so hidden assets do not miss renewal windows.
Bottom line: Certificate management is moving into a continuous operating model because shorter lifetimes and shrinking validation windows leave little tolerance for manual workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →