Topic starter
23/10/2026 12:46 am
TL;DR: Certificate governance gets harder as Cloudflare moves toward public CA status, with Red Sift placing issuer diversity and stricter ACME Renewal Information support at the center of the change. Certificate estates now need inventory, issuer visibility and client validation, or renewal automation can turn into lifecycle drift.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Cloudflare certificate authority: what it means for you”.
By the numbers:
- Let's Encrypt issues around 10 million certificates a day and serves more than 500 million sites.
- Under CA/Browser Forum ballot SC-081v3, maximum certificate lifetimes drop to 100 days in March 2027 and 47 days in March 2029.
Key questions
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: What breaks when ACME clients cannot support renewal coordination signals?
A: When clients cannot handle coordinated renewal signals, certificate replacement becomes fragmented during revocation or policy change.
Q: How should teams handle certificate governance when new public CAs enter the ecosystem?
A: Treat CA diversity as an inventory and policy problem, not just a trust-store issue.
Practitioner guidance
- Inventory every public certificate issuer Track all trusted issuers across your environment, including partner CAs and any future Cloudflare-issued certificates, so issuer changes do not blend into routine renewal noise.
- Validate ACME client support for ARI Confirm that every ACME client can process ACME Renewal Information so revocation-driven renewal changes are handled automatically rather than manually.
- Prepare dual-format monitoring for classic and post-quantum certificates Plan to observe classic certificates and Merkle Tree Certificates as separate operational populations during the migration period, with distinct compatibility checks and expiry handling.
Bottom line: Cloudflare’s move to become a public CA raises the governance bar for certificate estates, especially where multiple issuers and automated renewal now coexist.
Glossary terms: Certificate Authority, ACME Renewal Information, Merkle Tree Certificate, Certificate Inventory
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Certificate sprawl is becoming a machine identity governance problem, not a PKI footnote. The article shows that issuer diversity, shorter lifetimes and automated renewal are converging. That means security teams need to treat public TLS certificates as governed credentials with lifecycle, scope and inventory requirements. The practitioner conclusion is simple: if you cannot see every certificate and issuer, you cannot govern the estate.
A question worth separating out:
Q: What does a parallel classic and post-quantum certificate estate mean for compliance and operations?
A: It means teams must govern two certificate populations at once, each with its own compatibility profile, monitoring logic and renewal rhythm. That increases the chance of blind spots if inventory is incomplete. Security and compliance teams need to confirm that controls can distinguish format, issuer and lifecycle stage cleanly.
👉 Read our full editorial: Cloudflare’s public CA plans intensify certificate lifecycle pressure
This post was modified 6 days ago by NHI Mgmt Group