Topic starter
25/06/2026 12:59 am
TL;DR: CA/B Forum policy will shorten public TLS certificate lifetimes from 398 days to 200 days in 2026, 100 days in 2027, and 47 days by 2029, compressing renewal windows and exposing manual lifecycle weaknesses, according to CyberArk. The real issue is not certificate duration itself, but whether identity governance can sustain continuous renewal, inventory, and ownership at machine scale.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “为 47 天 TLS 证书有效期做好准备”.
Key questions
Q: What breaks when certificate lifetimes shrink to 47 days?
A: Manual certificate processes break first, followed by renewal consistency, deployment timing, and outage tolerance.
Q: Why do shorter certificate lifecycles increase operational risk?
A: Shorter lifecycles increase risk because they compress the time available for human coordination, which exposes weak inventory, unclear ownership, and inconsistent deployment paths.
Q: How do teams know whether certificate automation is actually working?
A: Look for fewer human-mediated renewals, cleaner ownership records, lower expiry-driven outage rates, and reliable reporting across hybrid systems.
Practitioner guidance
- Build a complete certificate inventory Map every public TLS certificate to an owner, expiry date, issuing CA and dependent service so renewal work is visible before the shorter lifecycle arrives.
- Automate renewal and deployment workflows Remove manual handoffs from renewal, validation and installation paths so certificate replacement can occur without waiting on individual operators.
- Assign named ownership for every certificate Tie each certificate to a responsible team or service owner, including inherited certificates created through mergers, acquisitions or cloud expansion.
Bottom line: Shorter TLS certificate lifecycles expose a governance gap in how organisations own, track and renew machine credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:07 am
47-day TLS validity creates a lifecycle governance problem, not just a PKI problem. The shorter the certificate term, the more certificate management behaves like NHI lifecycle governance and less like occasional infrastructure maintenance. Manual renewal assumptions break because the control surface now includes discovery, ownership, rotation timing and deployment coordination across many systems. The practitioner conclusion is clear: certificate governance has to be continuous, not periodic.
A question worth separating out:
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
👉 Read our full editorial: 47-day TLS certificate lifecycles will expose manual renewal gaps