Topic starter
24/06/2026 7:27 pm
TL;DR: Shorter TLS certificate lifetimes would compress validation reuse windows far faster, making the reuse window the key pressure point according to DigiCert. Certificate lifecycle work has to shift from occasional renewal to continuous automation before expiry and validation timing turn into outage risk.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “47 Days: The New Certificate Lifetime Proposed by Apple”.
By the numbers:
- The current maximum lifetime of a TLS certificate is 398 days.
- As of March 15, 2029, the lifetime SHOULD not exceed 46 days and MUST not exceed 47 days.
- Currently, validation reuse for subject identity information is allowed for up to 825 days.
Key questions
Q: Why do short-lived TLS certificates increase operational risk?
A: Short-lived TLS certificates increase operational risk because every renewal creates another chance for delay, misconfiguration, or missed deployment.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Q: How should security teams prepare for shorter TLS certificate lifetimes?
A: Security teams should start by inventorying every certificate, identifying owners, and automating renewal for all high-risk and high-volume systems.
Practitioner guidance
- Automate the full certificate lifecycle Connect request, validation, issuance, installation, and renewal so no step depends on a person remembering the next deadline.
- Shorten validation dependencies Track how long domain and organisational validation evidence is reused and retire workflows that assume long-lived approval data.
- Inventory certificate deployments continuously Maintain real-time visibility into where certificates are installed, which systems depend on them, and which renewals are approaching.
Bottom line: Shorter TLS certificate lifetimes turn certificate management into a continuous operational control problem rather than a periodic renewal task.
Glossary terms: Certificate Lifecycle Management, Validation Reuse Window, Machine Identity, Certificate Automation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 22 hours ago by NHI Mgmt Group
25/06/2026 4:43 am
47-day certificates turn certificate management into machine identity governance: This proposal collapses the comfortable distance between issuance and expiry that many teams still assume. A certificate is no longer a long-lived artefact with periodic renewal, it is a tightly bounded trust token that must be governed continuously. The practitioner conclusion is that certificate operations now sit in the same governance conversation as other non-human identities.
A question worth separating out:
Q: What is the difference between certificate visibility and certificate lifecycle automation?
A: Certificate visibility tells you what exists, where it is, and who depends on it. Certificate lifecycle automation goes further by orchestrating request, approval, issuance, installation, renewal, and audit with less manual intervention. Teams need visibility first because automation cannot reliably fix assets they cannot find, classify, or assign to an owner.
👉 Read our full editorial: 47-day TLS cycles make validation reuse the real bottleneck
This post was modified 22 hours ago by NHI Mgmt Group