Topic starter
11/11/2026 6:05 pm
TL;DR: Renewal windows are shrinking fast, according to MarkMonitor, and certificate teams will face outages if they still depend on manual tracking. Lifecycle automation, inventory and profile separation now determine whether TLS operations stay stable.
Editorial analysis by NHI Mgmt Group, based on content published by MarkMonitor: “TLS/SSL Certificate Lifetimes Are Getting Shorter — and Renewal Risk Is Rising”.
By the numbers:
- Starting on February 23, 2026, public TLS/SSL certificates purchased through Markmonitor will no longer be issued beyond 199 days.
- By Mar 2029, the maximum TLS/SSL lifetime will fall to 47 days.
- Beginning May 1, 2026, browsers will no longer trust certificates that include both Server Authentication EKU and Client Authentication EKU.
Key questions
Q: Why do mixed server and client EKU certificates create governance problems?
A: Mixed server and client EKU certificates create governance problems because a single certificate can be valid for both TLS server authentication and client authentication, widening its usable scope beyond the intended workload or user.
Q: How should teams inventory certificates across domains and applications?
A: Teams should inventory certificates by collecting every certificate, its subject, issuer, serial number, EKU, expiry, private key location, and the service, host, application, or workload that uses it.
Q: Why do shrinking certificate lifetimes make manual renewal risky for enterprise workloads?
A: Shorter certificate lifetimes sharply increase the number of renewals teams must complete each year, which turns human tracking into an operational bottleneck.
Practitioner guidance
- Automate renewal across the full certificate estate Build issuance, deployment and validation workflows that run without manual ticket chasing, especially where lifetimes are moving from months to weeks.
- Separate server-auth and client-auth certificate paths Identify every mutual TLS use case and issue dedicated client authentication certificates instead of reusing mixed-purpose certificates.
- Map every certificate to an owner and dependent service Maintain a live inventory that ties each certificate to the systems, domains and teams that will fail if renewal slips.
Bottom line: Shorter TLS lifetimes convert certificate renewal from a routine task into a recurring availability risk across websites, APIs and SaaS integrations.
Glossary terms: TLS/SSL Certificates, Extended Key Usage, Mutual Tls, Certificate Lifecycle Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Short-lived certificates turn renewal into a governance discipline: when validity windows compress, the control is no longer the certificate itself but the organisation's ability to track, approve and replace it on time. That shifts responsibility from isolated platform owners to a governed lifecycle that spans security, operations and application teams. The practical conclusion is that certificate ownership must be treated as a managed control, not a local admin task.
A question worth separating out:
Q: What happens when domain validation rules tighten for TLS issuance?
A: When domain validation rules tighten for TLS issuance, certificate authorities require stronger proof that the requester controls the domain before issuing a certificate. Requests that once passed with weaker checks may fail, renewals can break, and organisations must update DNS records, HTTP validation paths, or certificate automation to match the stricter validation method.
👉 Read our full editorial: Shorter TLS lifetimes make certificate automation a necessity