Topic starter
10/07/2026 9:14 pm
TL;DR: Certificate lifecycle management failures have caused global outages, and the move toward 47-day TLS certificates by 2029 will multiply renewal pressure by nearly 8x, according to eMudhra. Manual tracking, partial discovery, and non-native automation are no longer compatible with enterprise-scale certificate operations, especially as post-quantum reissuance approaches.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “What Is Certificate Lifecycle Management (CLM)? The Definitive 2026 Guide”.
By the numbers:
- The CA/Browser Forum approved a phased reduction of public TLS certificate lifetimes from 398 days today down to 47 days by 2029.
Key questions
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Q: Why does 47-day TLS create a governance problem instead of just more work?
A: Because shorter validity periods multiply renewal events and compress the time available to detect, approve, issue, and deploy certificates.
Q: What are the signs that certificate management is failing in practice?
A: Common warning signs include expired certificates, frequent renewal delays, inconsistent installations, and heavy reliance on spreadsheets or ad hoc tracking.
Practitioner guidance
- Build continuous certificate discovery Scan cloud key vaults, load balancers, internal CAs, certificate transparency logs, and active endpoints so shadow certificates are visible before they expire or drift out of policy.
- Automate renewal and deployment end to end Use protocol-native automation such as ACME, EST, or SCEP so renewal includes validation, issuance, and deployment instead of stopping at certificate creation.
- Validate hybrid PQC issuance now Test whether the platform can issue hybrid certificates that carry both classical and post-quantum algorithms without manual workarounds or roadmap dependence.
Bottom line: Certificate lifecycle failures are now an identity governance problem because certificates authenticate the services and workloads that modern enterprises rely on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:37 pm
Certificate lifecycle management has crossed from infrastructure hygiene into identity governance. Certificates now authenticate workloads, services, devices, and internal platforms, so expiry, revocation, and issuance are lifecycle controls rather than back-office administration. When the certificate estate is not continuously governed, the organisation is not merely risking downtime; it is losing control over machine identity trust.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams prepare certificate estates for post-quantum migration?
A: Start with inventory, dependency mapping, and lifecycle automation. Teams need to know which applications, devices, and machine identities depend on each trust chain before they can safely introduce post-quantum algorithms. Without that visibility, migration becomes reactive, with outages and policy drift happening after the change instead of before it.
👉 Read our full editorial: Certificate lifecycle management is now an identity governance issue