Topic starter
19/12/2025 11:34 am
TL;DR: Machines now outnumber people by more than 80 to 1, and phased browser rules will drive TLS certificate lifetimes down to 47 days by 2029, according to CyberArk and Gartner. Manual certificate management will not scale; automation becomes the control that keeps machine identities online and auditable.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “The next identity frontier: Automating PKI and certificate management before the 47-day era arrives”.
Key questions
Q: How should security teams prepare for shorter TLS certificate lifetimes?
A: Security teams should start by inventorying every certificate, identifying owners, and automating renewal for all high-risk and high-volume systems.
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable.
Practitioner guidance
- Discover every certificate and owner Build an inventory that covers workloads, APIs, containers, and services, then tie each certificate to an accountable owner before renewal pressure increases.
- Automate renewal workflows Replace manual renewals with policy-driven workflows that can handle short-lived public TLS certificates without relying on ticket queues or spreadsheet tracking.
- Measure renewal volume against staff capacity Model how 47-day lifetimes change operational load so identity and platform teams can see where human-operated renewal will fail first.
Bottom line: Shorter TLS lifetimes turn certificates into recurring machine identity events that manual teams struggle to govern reliably.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:30 pm
Machine identity governance is now an uptime discipline, not a back-office certificate task. When TLS lifetimes compress, expiry stops being a rare maintenance event and becomes a recurring business control. That shifts PKI and CLM from infrastructure administration into identity governance, where ownership, policy, and lifecycle enforcement are the actual control plane. The implication is that teams that still treat certificates as static assets will keep discovering failures too late.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What is the difference between PKI automation and certificate lifecycle management?
A: PKI automation focuses on automating certificate issuance, provisioning, renewal, revocation, and related workflows inside the trust infrastructure. Certificate lifecycle management is broader governance over discovery, ownership, reporting, and control of certificates across the environment. In practice, PKI automation helps execute the work, while lifecycle management helps ensure the organization knows what exists and who is responsible for it.
👉 Read our full editorial: 47-day TLS certificates will force machine identity automation