Topic starter
25/06/2026 12:24 am
TL;DR: Shorter TLS certificate lifetimes, including a step-down to 200 days in 2026, 100 days in 2027, and 47 days by 2029, make automation non-negotiable for certificate renewal and PQC readiness, according to DigiCert. Manual certificate operations will not scale to crypto-agility, inventory discipline, or hybrid algorithm transitions.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Why Shorter TLS Validity Raises the Bar”.
Key questions
Q: What breaks when TLS certificate lifetimes become very short?
A: Manual renewal processes break first, followed by validation, deployment, and monitoring workflows that were designed around longer validity windows.
Q: Why does shorter TLS validity increase post-quantum cryptography risk?
A: Because it forces organisations to make cryptographic change operationally repeatable.
Q: How do teams know whether certificate automation is actually working?
A: Look for fewer human-mediated renewals, cleaner ownership records, lower expiry-driven outage rates, and reliable reporting across hybrid systems.
Practitioner guidance
- Run a cryptographic inventory sprint Catalog where certificates, keys, and protocols are used, who owns them, and what changes if the cryptography must be swapped.
- Automate certificate discovery and renewal Use ACME or API-driven issuance to renew and deploy certificates across web servers, load balancers, and cloud endpoints before shorter lifetimes take effect.
- Separate cryptographic policy from application code Use PKI, certificate lifecycle management, and HSM-backed abstractions so algorithm changes do not require rebuilding applications.
Bottom line: Shorter TLS validity turns certificate lifecycle management into a continuous governance problem, not a periodic admin task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:18 am
Shorter certificate lifetimes convert PKI from a periodic maintenance activity into a standing governance function. The operational burden is no longer about occasional renewal events but about continuous discovery, policy enforcement, and deployment assurance. That shifts certificate lifecycle management into the same discipline class as identity lifecycle management. Practitioners should treat certificate automation as core trust infrastructure, not an efficiency project.
A question worth separating out:
Q: Should organisations prioritise inventory or automation first for PQC readiness?
A: They should do both, but inventory comes first when ownership and exposure are unclear. Automation without a reliable inventory can accelerate the wrong assets, while inventory without automation cannot sustain shorter certificate lifetimes. The sequence matters because the inventory tells teams what to automate and why.
👉 Read our full editorial: Shorter TLS validity makes PQC certificate automation unavoidable