Topic starter
12/07/2026 12:21 pm
TL;DR: SSL/TLS certificate validity is moving from 398 days to 47 days by 2029, while many organisations still rely on manual certificate management that cannot keep pace with rotation, inventory, and renewal pressure, according to GlobalSign. The operational shift makes certificate lifecycle governance a workload identity problem as much as a PKI problem.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Steven Hall”.
Key questions
Q: What breaks when SSL certificate lifecycle management is not in place?
A: When certificate lifecycle management is weak, services can fail at expiry, trust chains can degrade silently and users may lose confidence in the site or application.
Q: Why do certificate inventories matter more as certificate validity periods shrink?
A: Because inventory is the prerequisite for lifecycle control.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable.
Practitioner guidance
- Automate certificate discovery and renewal Replace spreadsheet-driven tracking with continuous discovery, renewal workflows and expiry alerting across cloud, application and infrastructure estates.
- Assign explicit certificate ownership Map each certificate to a service owner, renewal owner and escalation path so accountability survives staff turnover and platform sprawl.
- Inventory machine identities alongside certificates Treat certificates as part of the wider machine identity estate, including where they support APIs, services, gateways and automation flows.
Bottom line: Shortening SSL/TLS lifecycles turns certificate management into a continuous governance problem, and manual renewal processes lose reliability as the window narrows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:35 pm
Certificate lifecycle compression is a machine identity governance issue, not just a PKI housekeeping problem. When validity windows shrink, the decisive control becomes whether every certificate has an owner, a source of truth and an automated renewal path. Organisations that still treat certificates as isolated admin objects will find that trust failures surface faster than manual processes can absorb them.
A question worth separating out:
Q: Should certificate governance sit with PKI teams or workload owners?
A: It should be shared, with PKI setting policy and automation standards while workload owners retain service accountability. Certificates support machine identities embedded in applications and infrastructure, so renewal cannot remain a central team’s isolated task. The best model combines central governance with local ownership of service impact.
👉 Read our full editorial: Certificate lifecycles are tightening as manual management breaks down