Topic starter
24/06/2026 7:22 pm
TL;DR: A wave of certificate and policy changes across 2026 and 2027 will shorten public TLS validity, enforce MPIC, validate DNSSEC, and retire legacy code signing, according to DigiCert’s trust calendar. Certificate lifecycle pressure is now a governance problem, not just a PKI operations issue.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Stay Ahead of What’s Changing in Digital Trust”.
Key questions
Q: What breaks when certificate lifetimes shrink to 47 days?
A: Manual certificate processes break first, followed by renewal consistency, deployment timing, and outage tolerance.
Q: Why do short-lived certificates increase governance risk?
A: Short-lived certificates increase governance risk because they compress the time available for manual review, approval, and replacement.
Q: How should security teams prepare for MPIC and DNSSEC enforcement?
A: They should test their issuance and DNS workflows against multi-perspective validation and signed DNS checks before enforcement dates take effect.
Practitioner guidance
- Map every certificate to an accountable owner Build a current inventory that ties each public TLS, code signing, and validation asset to a named service owner, renewal path, and escalation route.
- Separate public TLS from code signing governance Track the certificate purpose before renewal planning so runtime trust and software signing follow different policies, approval paths, and failure handling.
- Test automation against MPIC and DNSSEC requirements Verify that issuance workflows, DNS controls, and validation tooling can support multi-perspective checks and DNSSEC-backed domain verification before the enforcement dates arrive.
Bottom line: Shorter certificate lifecycles turn renewal into a governance and ownership problem, not a periodic admin task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:38 am
Shorter certificate validity turns PKI into a governance discipline, not an operations calendar. When renewal windows shrink from years to months, the control problem moves from occasional replacement to continuous lifecycle assurance. That changes ownership, escalation, and evidence collection across machine identity estates. Practitioners should treat certificate expiry as a governance signal, not just a service outage risk.
A question worth separating out:
Q: What is the difference between certificate lifetime and domain validation reuse?
A: Certificate lifetime is how long an issued SSL/TLS certificate remains valid before it expires. Domain validation reuse is how long a certificate authority can keep relying on prior proof of domain control before checking it again. The two timelines are related but separate, and both are shrinking, which means organisations must renew certificates and revalidate domains more often.
👉 Read our full editorial: Digital trust planning is tightening as certificate lifecycles shrink