Topic starter
23/06/2026 7:24 pm
TL;DR: Shorter TLS lifecycles are pushing certificate renewals from an annual task toward continuous operations, with DigiCert positioning the Partner Subscriptions API and ACME automation as a delivery model for partners to manage that shift. The real issue is not issuance volume alone, but the collapse of manual certificate administration as a sustainable control.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Introducing the DigiCert Partner Subscriptions API”.
By the numbers:
- TLS certificate lifecycles will drop from 200 days today to 47 days in early 2029.
Key questions
Q: How should teams prepare certificate operations for 47-day TLS lifecycles?
A: Teams should move from periodic renewal handling to always-on certificate lifecycle governance.
Q: Why do manual certificate processes create more risk as lifespans shorten?
A: Manual processes create risk because the control window collapses faster than human teams can reliably track.
Q: What breaks when certificate issuance is not automated with ACME?
A: What breaks is the assumption that humans can reliably process renewals fast enough to avoid outages.
Practitioner guidance
- Map certificate ownership to a named lifecycle owner Assign a single accountable owner for certificate issuance, renewal, SAN changes, and retirement so responsibility does not fragment between partner, customer, and platform teams.
- Move renewals onto automated ACME workflows Use ACME-based renewal paths for customer domains where certificate validity is shortening, and eliminate renewal steps that depend on manual ticket handling.
- Review subscription and entitlement scope Track which domains, subaccounts, and contract terms are covered by each certificate entitlement so scope changes remain auditable during the subscription term.
Bottom line: Shorter TLS lifecycles turn certificate renewal into a continuous operational discipline, and manual handling becomes progressively less defensible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:24 am
Certificate renewal is becoming a lifecycle governance problem, not a ticketing problem. When certificate terms compress to 47 days, manual renewal turns into an unbounded operational burden. That changes the subject from occasional administration to continuous identity lifecycle control. Practitioners should treat certificate renewal as part of workload and service availability governance, not a back-office exception.
A question worth separating out:
Q: Who should own certificate entitlement changes in a partner subscription model?
A: Ownership should sit with a clearly defined lifecycle authority that can approve creation, renewal, SAN changes, and cancellation. When those decisions are split across support, sales, and engineering, certificate scope becomes hard to audit and even harder to retire cleanly. Governance needs one accountable owner per entitlement.
👉 Read our full editorial: DigiCert Partner Subscriptions API and the move to 47-day TLS