Topic starter
03/12/2025 2:48 pm
TL;DR: TLS certificate lifespans will drop from 398 days to 200 days in March 2026, and CyberArk says 67% of organisations already experience certificate-related outages monthly. The change turns certificate lifecycle management into an operational control point, not a background task, because manual renewal processes will not scale.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “TLS certificate management in 2026: The endless game of Whack-A-Cert”.
By the numbers:
- TLS certificate lifespans will drop from 398 days to 200 days in March 2026.
- CyberArk research shows that 67% of organisations experience certificate-related outages monthly.
Key questions
Q: What breaks when public TLS certificate lifespans shrink but renewal stays manual?
A: Manual renewal breaks first because the lifecycle becomes too compressed for ticket-based workflows to handle reliably.
Q: Why do shorter TLS lifetimes increase outage risk?
A: Shorter lifetimes compress the time available to detect, approve, renew, and deploy certificates before expiry.
Q: How do security teams know if certificate lifecycle management is working?
A: Certificate lifecycle management is working when every certificate has a clear owner, renewal is automated or tightly managed, and expiry cannot occur without escalation.
Practitioner guidance
- Automate certificate discovery and renewal Build an authoritative inventory of TLS certificates, map each one to an owner, and trigger renewal workflows before expiry rather than relying on spreadsheet tracking.
- Assign ownership for every certificate Ensure each machine identity has a named operational owner, a renewal path, and an escalation route so that expiry never becomes an unowned event.
- Model service dependencies around expiry risk Identify which customer-facing systems, APIs, and internal platforms depend on each certificate so you can estimate outage blast radius before renewal fails.
Bottom line: Shorter TLS lifespans turn machine identity governance into a recurring operational risk, especially where renewal still depends on manual tracking.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:33 pm
Certificate lifecycle management has become a machine identity control plane, not a housekeeping task. Shorter TLS lifespans force organisations to govern certificates with the same seriousness they apply to access rights and privilege. The control is no longer whether certificates exist, but whether they can be discovered, assigned, renewed, and retired at machine speed. Practitioners should stop treating CLM as an isolated infrastructure chore.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when a certificate expiry causes an outage?
A: Contain the outage by restoring trust for the affected service, identify the missing renewal control, and trace which dependent systems were impacted. Then fix the governance failure, not just the expired asset. If the same renewal process can fail again, the incident response is incomplete.
👉 Read our full editorial: Shorter TLS certificate lifespans will stress machine identity governance