Topic starter
25/08/2026 9:14 am
TL;DR: The CA/Browser Forum’s phased move to 47-day TLS certificates turns machine identity management from a renewal task into an operational resilience problem, according to Thryam. Manual tracking, partial automation, and incomplete visibility cannot sustain the new cadence, which makes discovery, inventory, and end-to-end automation the real control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Thryam: “47-Day Countdown: Why Machine Identity Is Critical Now”.
By the numbers:
- A team managing 1,000 certificates with each renewal taking 4 hours would grow from 2 people today to 16 by 2029.
- The CA/Browser Forum’s phased timeline reaches a maximum validity of 47 days by March 2029.
Key questions
Q: What breaks when 47-day certificate cycles meet partial automation?
A: Partial automation breaks because it only covers the certificates teams already know about.
Q: Why do shorter certificate lifetimes create more risk for infrastructure teams?
A: Shorter lifetimes compress the time available to discover assets, confirm ownership, obtain approvals, and deploy replacements.
Q: What are the signs that machine identity governance is no longer keeping up?
A: Common signs include surprise certificate expirations, repeated manual renewals, inconsistent policy enforcement, and teams that cannot answer who owns a given key or trust anchor.
Practitioner guidance
- Build a complete machine identity inventory Map every certificate, SSH key, and related cryptographic asset across cloud, on-premise, container, and edge environments.
- Automate the full certificate lifecycle Extend automation beyond renewal to discovery, monitoring, procurement, deployment, and revocation.
- Eliminate orphaned SSH keys and shared credentials Identify keys that outlived role changes, departures, or system decommissioning, then revoke them and assign ownership to a named service or team.
Bottom line: The article frames 47-day certificates as a machine identity governance problem, because renewal speed now depends on visibility and ownership rather than scripting alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 9:14 am
47-day certificate cycles expose a machine identity governance gap, not just a renewal problem. The article is right to treat shorter validity as a forcing function because the real weakness is the operating model behind it. If renewal depends on humans noticing assets, finding owners, and coordinating deployment, the lifecycle is already too brittle for the new cadence. The practitioner implication is that machine identity governance must be treated as continuous infrastructure control.
A question worth separating out:
Q: How should teams govern certificates and SSH keys as one lifecycle?
A: Treat them as parts of the same trust fabric rather than separate technical tasks. One inventory, one ownership model, and one lifecycle process reduce blind spots, align accountability, and make automation workable across hybrid infrastructure.
👉 Read our full editorial: Machine identity management breaks under 47-day certificate cycles