Notifications
Clear all
Topic starter
24/06/2026 10:30 pm
TL;DR: Certificate lifecycle management now has to absorb shrinking certificate validity, outage prevention, and audit visibility as renewal windows compress and manual handling becomes less viable, according to Akeyless. The real issue is no longer just certificate expiry, but whether identity programmes can govern machine trust at the pace infrastructure now demands.
NHIMG editorial — based on content published by Akeyless: Certificate Lifecycle Management (CLM) and the case for automated renewal
By the numbers:
- Only 38% have automated certificate lifecycle management in place.
- 69% of organisations now have more machine identities than human ones.
Questions worth separating out
Q: How should security teams govern certificate lifecycles across hybrid infrastructure?
A: They should treat certificates as credentials with owners, expiry dates, deployment targets, and revocation paths.
Q: Why do short certificate validity periods increase operational risk?
A: Shorter validity periods compress the time available for manual renewal and amplify the cost of missed handoffs.
Q: What breaks when certificate discovery is incomplete?
A: Incomplete discovery leaves shadow certificates, unknown trust paths, and unowned endpoints outside policy.
Practitioner guidance
- Inventory every certificate and assign ownership Build a central repository for all public and private certificates, including issuing authority, expiry date, deployment location, and business owner.
- Automate renewal and deployment workflows Remove manual steps from renewal, key generation, and redeployment across Linux, Windows, and Kubernetes estates so expiry does not become an operational event.
- Link revocation to incident and change processes Ensure compromised, retired, or replaced certificates are revoked through the same change and incident workflows used for other credentials, so trust is removed when the asset or relationship changes.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step certificate discovery and renewal workflow details across Linux, Windows, and Kubernetes environments
- Specific explanations of private CA and PKI-as-a-service setup options for internal trust relationships
- Practical handling of expiration notifications, automated deployment, and revocation sequencing
- The article's full discussion of CA/Browser Forum validity changes and their operational impact
👉 Read Akeyless's analysis of certificate lifecycle management and automated renewal →
Certificate lifecycle management: are manual controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 7:12 am
Certificate lifecycle management has become a machine identity governance problem, not a maintenance task. Certificates now function as credentials for services, workloads, and sometimes users, which places them squarely inside NHI governance. Manual renewal and renewal reminders do not scale when certificates are embedded in hybrid infrastructure and Kubernetes estates. The practical conclusion is that lifecycle control must be treated as identity control, with ownership, visibility, and revocation built into the operating model.
A few things that frame the scale:
- Only 38% have automated certificate lifecycle management in place, according to The Critical Gaps in Machine Identity Management report.
- 61% rely on spreadsheets or manual tracking for machine identity management, which shows how often lifecycle control still depends on fragile human process rather than governed automation.
A question worth separating out:
Q: Who is accountable when a certificate expires and an application goes down?
A: Accountability should sit with the service owner, with clear operational ownership from platform and identity teams for lifecycle automation. If certificate expiry is not mapped to an accountable owner and a tested renewal path, the organisation is relying on tribal knowledge rather than a governed control.
👉 Read our full editorial: Certificate lifecycle management is becoming a trust control problem
