Notifications
Clear all
Topic starter
11/07/2026 8:43 pm
TL;DR: Enterprise certificate lifetimes are shrinking from multi-year cycles toward one-year and, in public PKI, potentially 47 days by 2029, according to Versasec, because manual renewal, revocation gaps, and cryptographic aging no longer fit modern credential management. Short-lived certificates turn renewal into a governance control, not an occasional admin task.
NHIMG editorial — based on content published by Versasec: Short-Lived Certificates in Credential Management: Why Automation is Key
By the numbers:
- The 2023 Insider Threat Report stated that 74% of respondents feel moderately to extremely vulnerable to insider threats.
Questions worth separating out
Q: How should organisations manage short-lived certificates in certificate-based authentication?
A: Organisations should treat short-lived certificates as a lifecycle control and automate issuance, renewal, revocation, and replacement.
Q: Why do short-lived certificates improve security more than long-lived ones?
A: They reduce the time a stale, misissued, or compromised certificate can remain trusted, and they force regular re-validation of ownership and policy.
Q: What breaks when certificate renewal is still handled manually?
A: Manual renewal breaks at scale because it creates missed expiries, uneven policy enforcement, and hidden exception handling.
Practitioner guidance
- Automate certificate renewal and invalidation Move renewal, re-issuance, and invalidation into a governed workflow so expiring credentials are handled before they become operational exceptions.
- Map certificate lifetimes to identity lifecycle events Tie certificate expiry to joiner, mover, and leaver processes so offboarding, role changes, and device replacement trigger the right credential action.
- Reduce dependence on manual renewal tickets Replace ticket-driven certificate maintenance with policy-based orchestration where possible.
What's in the full article
Versasec's full article covers the operational detail this post intentionally leaves for the source:
- The rationale for shorter certificate lifetimes across TLS, smart card logon, and signing certificates.
- The operational difference between manual renewal and CMS-driven orchestration for frequent certificate replacement.
- The security hygiene argument for eliminating revocation gaps when employees or contractors leave.
- The crypto-agility implications of moving from multi-year certificate cycles to a one-year standard.
👉 Read Versasec's analysis of short-lived certificates and automation in credential management →
Short-lived certificates and CBA renewal: are your controls ready?
Explore further
11/07/2026 9:10 pm
Short-lived certificates are a lifecycle control, not a certificate preference. The important change is that trust must now be re-earned on a tighter schedule, which forces identity teams to treat certificates as governed credentials instead of static assets. That aligns with OWASP-NHI thinking around lifecycle and credential exposure, and it is the right model for environments where offboarding and policy drift are the real failure points. Practitioners should judge certificate programmes by how reliably they invalidate stale trust.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- A separate finding from the same report shows that 44% of NHI tokens are exposed in the wild, being sent or stored over Teams, Jira, Confluence, and code commits.
A question worth separating out:
Q: Who should own certificate lifecycle governance in an IAM programme?
A: Ownership should sit with the team responsible for identity governance, with clear operational participation from certificate administrators and platform owners. The important point is end-to-end accountability for issuance, renewal, revocation, and offboarding. Without explicit ownership, certificate lifecycle controls become fragmented and inconsistent.
👉 Read our full editorial: Short-lived certificates are becoming the new baseline for CBA
