Topic starter
25/06/2026 10:49 pm
TL;DR: As public TLS validity shrinks from 398 days toward a possible 47-day ceiling by 2029, PKI teams face higher renewal volume, faster revocation expectations, and a stronger case for automation, according to Keyfactor. Short-lived certificates reduce the damage window for key compromise, but they also expose how much certificate governance still depends on manual process.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Why Short-Lived TLS Certificates Are the Future of Public Key Infrastructure (PKI)”.
Key questions
Q: What breaks when public TLS certificate lifespans shrink but renewal stays manual?
A: Manual renewal breaks first because the lifecycle becomes too compressed for ticket-based workflows to handle reliably.
Q: Why do short-lived certificates push teams toward automation?
A: Short-lived certificates compress the time available for discovery, approval, deployment, and revocation.
Q: How do organisations know if lifecycle controls for certificates are effective?
A: They know by tracking renewal success rate, time to issuance, remediation speed, and unplanned expirations over time.
Practitioner guidance
- Map every public certificate to an owner and renewal path Build a complete inventory of public TLS certificates, then assign accountable owners for issuance, deployment, renewal, and revocation before lifetimes shrink further.
- Automate discovery-to-renewal workflows Remove manual handoffs from the certificate lifecycle so discovery, renewal, and revocation happen through an enforced workflow instead of a ticket queue.
- Set revocation expectations for compromised certificates Define how quickly compromised certificates must be revoked and verified as replaced, then test whether those expectations can be met under real operating conditions.
Bottom line: Shorter TLS certificate lifetimes reduce compromise exposure, but only when the renewal and revocation process is reliable enough to keep pace.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:31 pm
Short-lived certificate governance is now a machine identity problem, not just a PKI maintenance problem. The article is really describing a shift from static certificate administration to continuous machine identity governance. Once validity periods compress, certificate ownership, inventory accuracy, and renewal assurance become inseparable from identity security outcomes. Practitioners should stop treating TLS certificates as isolated assets and start treating them as governed machine identities with expiry-driven enforcement.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: When should security teams prioritise certificate lifecycle automation over ad hoc renewal work?
A: They should prioritise automation as soon as certificate counts, renewal frequency, or service criticality make manual handling unreliable. If a missed renewal can cause downtime or a compromised certificate can remain trusted too long, lifecycle automation is no longer optional. It is the control that keeps PKI operational at scale.
👉 Read our full editorial: Short-lived TLS certificates are reshaping PKI governance