Topic starter
06/06/2026 1:42 am
TL;DR: Publicly trusted TLS certificate lifetimes are shrinking from 200 days in 2026 to 100 days in 2027 and 47 days in 2029, turning certificate management into continuous operations rather than occasional administration, according to Keyfactor. The real risk is not renewal frequency but the operating model gap between inventory thinking and repeatable lifecycle automation.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “100-Day Certs Are Next: Why Your Q2 Automation Investment Pays Off in 2027”.
Key questions
Q: What breaks when certificate lifetimes shrink faster than teams can renew manually?
A: Manual certificate management breaks at the coordination layer first.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: How do security teams know if certificate lifecycle management is working?
A: Certificate lifecycle management is working when every certificate has a clear owner, renewal is automated or tightly managed, and expiry cannot occur without escalation.
Practitioner guidance
- Build a complete certificate inventory Identify every publicly trusted TLS certificate, its owner, deployment target, validation dependency, and renewal path so the lifecycle can be managed as a live service.
- Assign accountable service owners Map each certificate to a named business or technical owner who can approve changes, remediate exceptions, and answer for missed renewals.
- Automate renewal and replacement workflows Remove manual handoffs from issuance, deployment, validation, and renewal so the process can keep pace as validity windows shrink.
Bottom line: Shorter certificate lifetimes expose the weakness of manual, spreadsheet-led renewal models.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 2:58 am
Continuous certificate operations is now the governance baseline: shrinking publicly trusted TLS lifetimes expose the weakness of programmes that still think in annual renewal cycles. Once the operating cadence tightens, the control surface is not the certificate itself but the process that discovers, owns, replaces, and audits it. The implication is that certificate management must be governed as a lifecycle service, not as an intermittent security task.
A question worth separating out:
Q: Should organisations treat certificate management as part of broader identity governance?
A: Yes. Certificates are credentials with a lifecycle, an owner, and a failure mode, so they belong in the same governance conversation as service accounts, tokens, and other non-human identities. Treating them separately usually produces gaps in accountability and inconsistent offboarding or renewal control.
👉 Read our full editorial: 100-day certs will force certificate operations into continuous mode