Topic starter
10/07/2026 9:21 pm
TL;DR: Digital certificates underpin website security, email, documents, software, and regulated systems, while Apple’s proposed 47-day TLS validity would force eight times more renewal activity than today, according to IdenTrust. That shifts certificate management from a PKI task into a standing NHI governance problem where lifecycle discipline matters more than one-time issuance.
Editorial analysis by NHI Mgmt Group, based on content published by IdenTrust: “pki”.
Key questions
Q: What breaks when TLS certificate lifetimes become very short?
A: Manual renewal processes break first, followed by validation, deployment, and monitoring workflows that were designed around longer validity windows.
Q: Why do TLS certificates belong in NHI governance?
A: TLS certificates are machine identities because they prove identity for workloads, services, and devices just as credentials do for people.
Q: How do security teams know if certificate lifecycle management is working?
A: Certificate lifecycle management is working when every certificate has a clear owner, renewal is automated or tightly managed, and expiry cannot occur without escalation.
Practitioner guidance
- Establish certificate ownership by service and business process Assign each certificate to a named system owner and a renewal owner so no certificate exists outside accountable governance.
- Inventory every certificate across web, email, code signing and device estates Create one authoritative view of active, expiring and orphaned certificates, including where they are deployed and who approved them.
- Automate renewal and revocation workflows for short-lived certificates Use controlled automation to reduce manual renewal failure while keeping revocation and exception handling under governance.
Bottom line: Shorter certificate lifetimes convert renewal from a periodic task into a standing governance obligation across the certificate estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:44 pm
Digital certificate lifecycle is now identity governance, not just PKI administration. Certificates are non-human identities because they authenticate systems, services and regulated workflows rather than people. Once renewal cadence becomes the dominant constraint, the real question is whether the organisation can govern inventory, ownership and retirement across the full certificate estate. The practitioner conclusion is that certificate management belongs in identity lifecycle governance, not in a narrow infrastructure bucket.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: Should certificate renewal be managed by infrastructure teams or IAM teams?
A: It should be governed jointly, but the ownership model must sit inside identity governance. Infrastructure teams usually know where the certificates are deployed, while IAM and GRC teams define lifecycle policy, accountability and audit evidence. If those responsibilities are split without a shared governance model, renewal gaps are almost inevitable.
👉 Read our full editorial: Digital certificate lifecycle is becoming an identity governance problem