Topic starter
11/07/2026 8:49 pm
TL;DR: Security teams are moving from one- and two-year certificate lifecycles toward 90-day or 30-day validity as browser limits, federal guidance, and crypto-agility pressures reshape PKI, according to eMudhra. Long-lived certificates no longer fit modern machine identity operations, where expiry, automation, and rollback discipline determine whether PKI reduces risk or creates outages.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Why Short PKI Certificate Lifecycles Matter”.
Key questions
Q: What breaks when certificate lifecycles move from years to months?
A: Manual renewal processes break first, followed by inventory accuracy and ownership clarity.
Q: Why do short-lived TLS certificates increase operational risk?
A: Short-lived TLS certificates increase operational risk because every renewal creates another chance for delay, misconfiguration, or missed deployment.
Q: How do security teams know if certificate lifecycle management is working?
A: Certificate lifecycle management is working when every certificate has a clear owner, renewal is automated or tightly managed, and expiry cannot occur without escalation.
Practitioner guidance
- Inventory every certificate Build a complete certificate register across public, private, cloud, and IoT estates, then map each certificate to an owner, expiry date, and renewal path.
- Automate renewal and revocation Use ACME or API-driven workflows for issuance, renewal, and revocation so short-lived certificates do not depend on manual intervention.
- Pilot short lifecycles on low-risk services Start with development APIs or similarly low-impact workloads to validate renewal timing, ownership, and outage recovery before moving to production-critical services.
Bottom line: Shorter certificate lifecycles turn PKI into an identity governance problem because every renewal, revocation, and exception now carries operational risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:15 pm
Certificate lifecycles are now a governance control, not a housekeeping task. Once validity drops from years to months, the certificate lifecycle itself becomes part of identity risk management. That changes the unit of governance from individual renewals to the integrity of the issuance, inventory, and retirement process. Practitioners should treat certificate lifecycle policy as a core NHI control plane.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What should organisations do when legacy systems cannot support short-lived certificates?
A: Isolate those systems, document the constraint, and grant only the minimum exception period needed for continuity. The goal is not to preserve long-lived certificates as a default, but to make every exception visible, justified, and time-bound so it does not become permanent.
👉 Read our full editorial: Shorter certificate lifecycles are now a PKI governance issue