Topic starter
06/11/2026 6:56 pm
TL;DR: TLS certificate renewal volume quickly outgrows manual PKI workflows once validity keeps shrinking, according to AppViewX research on 47-day TLS certificate management. Practitioners need inventory, policy and deployment automation to avoid outages and governance drift.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “From Annual to Automatic: An Executive’s Step-by-Step Guide to 47-Day TLS Certificate Compliance”.
Key questions
Q: Why do shorter certificate lifespans increase outage risk?
A: Shorter lifespans compress the time available for discovery, approval, renewal, and validation.
Q: How does ACME support automated certificate renewal?
A: ACME supports automated certificate renewal by letting a certificate authority issue or reissue certificates through a protocol exchange that proves control of the requested domain or identifier.
Q: How should teams build a certificate lifecycle inventory?
A: Teams should build a live certificate inventory that spans cloud, on-prem, Kubernetes, SaaS and partner-facing services, with ownership, expiry and issuing CA data attached to each record.
Practitioner guidance
- Map the full certificate estate Create a live inventory that covers cloud, on-prem, Kubernetes, SaaS and partner-facing endpoints, then assign ownership to every certificate record.
- Centralise certificate issuance policy Route public and private certificate requests through one governed process that enforces validity, key size, SAN and ownership rules.
- Enable ACME for self-service renewal Expose automated renewal paths for workloads, containers and application teams so routine certificate changes do not depend on tickets.
Bottom line: The main risk is not just expiry, but the loss of control that comes when certificate volume outruns manual governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
47-day TLS makes certificate inventory a governance prerequisite: the decisive control is no longer renewal speed alone, but whether every certificate is visible, owned and tied to a policy path. Without that inventory, automation only covers the known edge of the estate and misses the assets most likely to fail under short validity windows. The implication is that certificate governance now sits across infrastructure, application and security ownership, not inside PKI alone.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between central issuance and local certificate requests?
A: Central issuance means certificates are requested and approved through one governed process, usually with policy, logging, and certificate authority oversight. Local certificate requests are generated and handled on the target system or by a local service, with less central control over enrolment, naming, and renewal. The main difference is where authority and policy enforcement sit.
👉 Read our full editorial: 47-day TLS turns certificate inventory into an executive control