Notifications
Clear all
Topic starter
12/07/2026 12:22 pm
TL;DR: Shorter code-signing certificate lifetimes move risk from long-lived trust assumptions to tighter renewal, inventory, and revocation discipline, according to GlobalSign. The practical issue is no longer certificate issuance alone, but whether teams can govern machine identity lifecycles fast enough to avoid service disruption and trust leakage.
NHIMG editorial — based on content published by GlobalSign: changing validity periods for code-signing certificates
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: What breaks when certificate validity gets shorter but ownership stays manual?
A: Manual ownership breaks first because expiry becomes a recurring operational deadline, not a rare event.
Q: Why do machine certificates belong in identity governance rather than only PKI?
A: Machine certificates authenticate systems, services, and code, so they are identities with lifecycle, scope, and revocation requirements.
Q: How do teams know whether certificate automation is actually working?
A: Look for fewer human-mediated renewals, cleaner ownership records, lower expiry-driven outage rates, and reliable reporting across hybrid systems.
Practitioner guidance
- Map every certificate to an owner and system Create a live inventory for code-signing, workload, and service certificates that records owner, usage scope, issuance source, expiry, and revocation path.
- Automate renewal with explicit approval gates Use ACME or equivalent automation for repeatable renewal, but require approval rules for high-trust certificates such as signing keys and externally exposed identities.
- Define revocation as a first-class offboarding control When a workload, service, or signing authority is retired, remove its certificate from trust stores, build systems, and deployment pipelines immediately.
What's in the full article
GlobalSign's full blog covers the operational detail this post intentionally leaves for the source:
- How certificate validity changes affect code signing, DevSecOps, and PKI operating models.
- Practical implications for teams using ACME to automate certificate issuance and renewal.
- What shorter lifetimes mean for release integrity, revocation discipline, and ownership tracking.
- The article's specific framing of certificate validity as a governance and trust problem.
👉 Read GlobalSign's analysis of changing code-signing certificate validity →
Certificate validity changes and the machine identity governance gap?
Explore further
12/07/2026 12:35 pm
Shorter certificate validity turns machine identity into a lifecycle discipline, not a procurement discipline. Organisations that treat certificates as static assets will struggle as renewal windows compress and automation becomes mandatory. The governance question is no longer how to buy or issue certificates, but how to maintain inventory, ownership, and revocation at machine speed. Practitioners should treat certificate lifecycle control as part of identity governance, not a separate PKI task.
A question worth separating out:
Q: Which frameworks help teams govern machine certificate lifecycles?
A: NIST Cybersecurity Framework 2.0 and Zero Trust Architecture both support the governance, protection, and resilience principles needed for modern certificate operations. Teams should use them to define ownership, automate repeatable controls, and reduce single points of failure across issuance and validation workflows.
👉 Read our full editorial: Certificate validity changes shift the burden to machine identity governance
