Topic starter
25/06/2026 12:08 am
TL;DR: CA/Browser Forum discussions in Warsaw point to mandatory automation support, the possible sunset of non-automatable DCV methods, and growing pressure to prepare for post-quantum TLS, according to DigiCert. The core issue is that certificate governance now depends on automation maturity, not manual processes that no longer scale.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Insights from the CA/Browser Forum’s Warsaw Discussions”.
Key questions
Q: What breaks when certificate validation still depends on manual DCV methods?
A: Manual DCV breaks when issuance policy expects automation, because human-mediated checks do not scale with renewal volume or browser-program change.
Q: Why do certificate automation requirements matter for PKI governance?
A: Automation requirements matter because they move certificate control from operator discretion to repeatable lifecycle policy.
Q: How should security teams prepare certificate estates for post-quantum migration?
A: Start with inventory, dependency mapping, and lifecycle automation.
Practitioner guidance
- Audit certificate automation coverage Inventory issuance, renewal, revocation, and replacement flows to identify where ticket-based or manual steps still control certificate lifecycle operations.
- Retire non-automatable DCV paths Find every validation workflow that depends on phone, email, fax, SMS, or postal mail and replace it with an automatable method before policy sunsets them.
- Separate mTLS and external trust requirements Map certificates that need client authentication or external trust into a dedicated PKI path so public Web PKI changes do not break application design.
Bottom line: Certificate governance is shifting toward automation-first lifecycle control as browser and CA policy evolves.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:57 am
Certificate lifecycle automation is becoming a governance baseline, not an optimisation choice. The CA/Browser Forum discussions show that root program expectations are moving from optional automation support to mandatory automation capability. That shifts certificate management out of exception handling and into policy-enforced lifecycle control. For practitioners, the important point is that the control plane itself is changing, so manual processes are increasingly out of step with how trust programs will operate.
A question worth separating out:
Q: When should organisations re-evaluate their certificate lifecycle model?
A: Organisations should re-evaluate it now if they still rely on manual validation, exception-driven renewals, or separate processes for public trust and internal issuance. Those patterns become brittle when browser policy changes faster than local certificate operations.
👉 Read our full editorial: CA/Browser Forum changes are reshaping certificate lifecycle management