Topic starter
24/10/2026 8:53 pm
TL;DR: 100-day TLS lifetimes are giving way to 47-day targets by 2029, Red Sift says in its blog analysis of PKI changes. Certificate operations need continuous monitoring because shorter validation windows leave little room for manual renewal paths.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Let's Encrypt webinar recap: Adapting to shorter certificate lifecycles and PKI changes”.
Key questions
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: What are the signs that certificate automation is not working well enough?
A: Common warning signs include fragmented visibility across certificate authorities, reliance on spreadsheets or homegrown trackers, missed expirations, and certificates that remain outside a central inventory.
Q: What breaks when certificate renewals still depend on manual approval?
A: Manual approval breaks when the renewal window is shorter than the time needed to notice, review, and act.
Practitioner guidance
- Automate certificate issuance and renewal Use ACME for every service where supported, and treat renewal as part of the service lifecycle rather than a periodic admin task.
- Monitor the full renewal path Track issuance success, renewal success, distribution, and service reload as separate observable steps so failures are visible before expiry.
- Map and verify complete certificate inventory Include public, private, internal, SaaS-embedded, decommissioned, and third-party certificates so hidden assets do not miss renewal windows.
Bottom line: Certificate management is moving into a continuous operating model because shorter lifetimes and shrinking validation windows leave little tolerance for manual workflows.
Glossary terms: ACME, Domain Control Validation, Certificate Inventory, Post-Quantum Cryptography
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Certificate lifecycle is becoming machine identity governance by another name: shorter lifetimes turn every certificate into a recurring credential event rather than a static asset. That shifts the control problem from occasional expiry handling to continuous ownership, validation, and revocation discipline. For identity teams, the important lesson is that certificates should be governed like other non-human identities, with clear lifecycle visibility and no reliance on remembered manual steps.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: How should teams respond when PQC affects both certificates and TLS key exchange?
A: They should separate the transport-security work from the certificate-format work. Hybrid key exchange can usually be planned earlier, while certificate migration depends on browser, CA, and device support. Splitting the programme reduces compatibility risk and makes progress possible before full ecosystem readiness arrives.
👉 Read our full editorial: Certificate lifetimes are shrinking, and automation must follow
This post was modified 6 days ago by NHI Mgmt Group