Notifications
Clear all
Topic starter
24/06/2026 11:36 pm
TL;DR: WebPKI is moving toward 47-day TLS certificates and 10-day domain validation, forcing certificate renewals, validation, and resilience planning into a continuous operational model, according to DigiCert’s white paper preview of upcoming CA/Browser Forum changes. Manual certificate lifecycles are becoming a reliability risk, and automation now sits at the center of trust governance.
NHIMG editorial — based on content published by DigiCert: A Blueprint for the Next Generation of Digital Trust
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should security teams prepare for shorter TLS certificate lifetimes?
A: Security teams should treat shorter TLS lifetimes as an operational redesign problem, not a certificate refresh task.
Q: Why do shorter certificate lifetimes increase operational risk?
A: Shorter lifetimes compress the window for renewal, validation, and error recovery.
Q: What breaks when certificate validation workflows are too slow?
A: Slow validation workflows create bottlenecks that delay issuance and increase the chance of failed renewals.
Practitioner guidance
- Automate certificate renewal end to end Remove manual renewal steps from every high-volume certificate path and enforce issuance through a repeatable workflow that can complete before expiry without human intervention.
- Map every certificate to an accountable owner Assign ownership for each certificate population, including dependencies on domain validation, revocation checking, and distribution services, so failures are traceable before expiry events.
- Test validation and renewal at peak load Simulate renewal bursts, validation retries, and service outages to confirm that certificate operations still succeed when change volume spikes beyond normal conditions.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- The white paper's architecture outline for scaling issuance systems to higher throughput without creating new failure points.
- The vendor's description of multi-zone and multi-CDN delivery choices for certificate status and trust resilience.
- The post's preview of AI-accelerated validation and ACME-based renewal mechanisms that support shorter lifetimes.
- The post's discussion of post-quantum readiness in the trust stack and how it fits into the broader modernization plan.
👉 Read DigiCert's white paper on upgrading WebPKI for 10X scale →
47-day TLS certificates: what this means for trust operations?
Explore further
25/06/2026 8:34 am
Certificate lifecycle management is becoming a machine identity governance problem, not just a PKI problem. Shorter TLS lifetimes turn every certificate into a continuously managed identity artifact, which means inventory, issuance, validation, and renewal must be governed as one lifecycle. The operational question is no longer whether certificates can be issued, but whether the organisation can keep pace without outage-prone manual work. Practitioners should treat certificate operations as part of broader NHI governance.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which helps explain why lifecycle and renewal failures persist across identity programmes.
A question worth separating out:
Q: Which frameworks help teams govern machine certificate lifecycles?
A: NIST Cybersecurity Framework 2.0 and Zero Trust Architecture both support the governance, protection, and resilience principles needed for modern certificate operations. Teams should use them to define ownership, automate repeatable controls, and reduce single points of failure across issuance and validation workflows.
👉 Read our full editorial: WebPKI is shifting to 47-day TLS certificates and 10-day validation
