Topic starter
06/06/2026 11:29 am
TL;DR: Certificate lifespans are shrinking from annual renewals to 200 days now and 47 days next, forcing approval cycles, ownership models, and deployment workflows to operate eight times as often, according to Keyfactor. The operational issue is not policy itself but the assumption that certificate lifecycle management can still be handled on a calendar cadence.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “When Policy Moves Faster Than People: Surviving the Shift to 47-Day Certificate Lifespans”.
By the numbers:
- As of March 15, 2026, maximum TLS certificate lifespans dropped to 200 days, with 100 days next and 47 days in another two years.
Key questions
Q: What breaks when certificate lifecycle management is not integrated with PKI operations?
A: Manual certificate management does not scale once certificate counts rise and lifetimes shrink.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.
Q: How do teams know whether certificate governance is actually working?
A: Look for three signals: clean issuance records, consistent revocation propagation, and matching status across PKI, endpoint security, and operations.
Practitioner guidance
- Map certificate ownership across every renewal path Identify the business owner, technical owner and deployment owner for each certificate class so renewal responsibility does not disappear when cadence accelerates.
- Automate renewal and deployment workflows Remove manual ticket queues and spreadsheet handoffs from the renewal path, especially where certificates are embedded in applications, workloads, APIs and devices.
- Inventory certificates continuously Maintain a current certificate inventory that includes expiry, location, dependency and owner so short validity windows do not create blind spots.
Bottom line: Shorter certificate lifespans expose a PKI operating model that still depends on slow human coordination rather than continuous control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:19 pm
Shorter certificate lifespans are a PKI governance stress test, not just a security improvement. The policy objective is clear: reduce exposure by shortening the time a certificate can be abused. But the practical effect is that every organisation now has to prove its certificate lifecycle is operable under much tighter cadence. The field should stop treating this as a certificate-length debate and start treating it as a governance-readiness test for PKI itself.
A question worth separating out:
Q: Should organisations prioritise automation or process redesign first for 47-day certificates?
A: Process redesign first, automation second. Automation only helps when ownership, approval paths and deployment responsibilities are already clear. Without that structure, the organisation automates confusion. The goal is a renewal model that can operate continuously, with automation reinforcing a governance design that already matches the shorter certificate lifecycle.
👉 Read our full editorial: 47-day certificate lifespans are exposing PKI governance gaps