Notifications
Clear all
Topic starter
08/07/2026 6:52 pm
TL;DR: Certificate expiry, renewal failure, and inventory gaps can still trigger outages at enterprise scale, as Bazel’s expired SSL certificates showed when recovery took about thirteen hours, according to Infisical. The real lesson is that certificate management fails when ownership, visibility, and alerting break down, not when renewal is merely manual.
NHIMG editorial — based on content published by Infisical: A Complete Guide to SSL/TLS and mTLS Certificate Management
By the numbers:
- The CA/Browser Forum is cutting the maximum public certificate lifetime from 398 days to 200 in March 2026, 100 in 2027, and 47 by 2029.
Questions worth separating out
Q: How should teams govern certificate expiry across large service estates?
A: Treat certificate expiry as an identity lifecycle control, not a calendar reminder.
Q: Why do certificate management failures matter to zero trust programmes?
A: Zero trust assumes that trust is explicit, limited, and continuously verified.
Q: What breaks when certificate ownership is distributed across teams?
A: Renewal and revocation become slower because no one has full visibility into what exists, where it is deployed, or who can change it.
Practitioner guidance
- Inventory all certificates as governed identity assets Create a single inventory across public edge, service-to-service, databases, Kubernetes, and device fleets.
- Alert on renewal failure before expiry becomes visible Monitor the renewal workflow itself, not only expiry dates.
- Separate issuance policy from human approval bottlenecks Use certificate profiles to define who can issue what, which issuers are allowed, and which certificates require approval.
What's in the full article
Infisical's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step certificate lifecycle workflows for issuance, deployment, renewal, and revocation across public and private certificates.
- Operational examples of how renewal automation, alerting, and propagation behave when certificates are spread across Kubernetes, service meshes, and databases.
- A deeper explanation of X.509 fields, PEM structure, and the TLS and mTLS handshake mechanics behind certificate trust.
- Infisical's implementation approach for centralised certificate management, including policy controls and CA integration.
👉 Read Infisical's guide to SSL/TLS and mTLS certificate management →
Certificate management at scale: where IAM teams miss the warning signs?
Explore further
08/07/2026 7:13 pm
Certificate expiry is an identity control failure, not a maintenance issue. The Bazel incident shows that expired certificates create direct operational impact when ownership, discovery, and renewal governance are not unified. In NHI terms, a certificate is a machine credential with a lifecycle, and lifecycle failure is a governance failure. Practitioners should treat certificate estates as part of identity governance, not as a sidecar operational task.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how remediation lag keeps machine credentials usable long after exposure.
A question worth separating out:
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
👉 Read our full editorial: SSL/TLS certificate management failures are really identity governance failures
