Topic starter
23/06/2026 7:24 pm
TL;DR: Shorter TLS lifecycles push renewal work into continuous operations, according to DigiCert. Certificate management now needs automation, ownership clarity, and ACME paths that can hold up as validity windows shrink.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Introducing the DigiCert Partner Subscriptions API”.
By the numbers:
- TLS certificate lifecycles will drop from 200 days today to 47 days in early 2029.
Key questions
Q: Why do manual certificate processes create more risk as lifespans shorten?
A: Manual processes create risk because the control window collapses faster than human teams can reliably track.
Q: What breaks when certificate issuance is not automated with ACME?
A: What breaks is the assumption that humans can reliably process renewals fast enough to avoid outages.
Q: How should teams prepare certificate operations for 47-day TLS lifecycles?
A: Teams should move from periodic renewal handling to always-on certificate lifecycle governance.
Practitioner guidance
- Map certificate ownership to a named lifecycle owner Assign a single accountable owner for certificate issuance, renewal, SAN changes, and retirement so responsibility does not fragment between partner, customer, and platform teams.
- Move renewals onto automated ACME workflows Use ACME-based renewal paths for customer domains where certificate validity is shortening, and eliminate renewal steps that depend on manual ticket handling.
- Review subscription and entitlement scope Track which domains, subaccounts, and contract terms are covered by each certificate entitlement so scope changes remain auditable during the subscription term.
Bottom line: Shorter TLS lifecycles turn certificate renewal into a continuous operational discipline, and manual handling becomes progressively less defensible.
Glossary terms: Certificate Lifecycle Management, ACME Automation, Certificate Entitlement, EAB Credentials
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
25/06/2026 3:24 am
Certificate renewal is becoming a lifecycle governance problem, not a ticketing problem. When certificate terms compress to 47 days, manual renewal turns into an unbounded operational burden. That changes the subject from occasional administration to continuous identity lifecycle control. Practitioners should treat certificate renewal as part of workload and service availability governance, not a back-office exception.
A question worth separating out:
Q: Who should own certificate entitlement changes in a partner subscription model?
A: Ownership should sit with a clearly defined lifecycle authority that can approve creation, renewal, SAN changes, and cancellation. When those decisions are split across support, sales, and engineering, certificate scope becomes hard to audit and even harder to retire cleanly. Governance needs one accountable owner per entitlement.
👉 Read our full editorial: 47-day TLS forces certificate management into continuous operations
This post was modified 23 hours ago by NHI Mgmt Group