Topic starter
06/11/2026 6:56 pm
TL;DR: 45-day certificates, tlsclient retirement, and new intermediates expose manual renewal and chain-checking gaps, according to AppViewX’s analysis of Let’s Encrypt’s May changes. Practitioners now need inventory by EKU and continuous chain logging.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “Let’s Encrypt’s May 13 Changes: 3 Renewal Workflow Updates”.
Key questions
Q: Why do client authentication certificates need separate inventory?
A: Client authentication certificates need separate inventory because they are issued and trusted for a different purpose from server certificates, typically via the clientAuth EKU.
Q: How can renewal logging prevent certificate chain failures?
A: Renewal logging prevents certificate chain failures by showing which certificate was renewed, which intermediate or root certificate was deployed, and whether every server and client received the same trust material.
Q: How do 45-day TLS certificates change renewal operations?
A: 45-day TLS certificates force renewal to become continuous rather than calendar-based, because the certificate expires before manual ticket queues and quarterly maintenance windows can cope.
Practitioner guidance
- Inventory certificates by EKU and owner Build discovery around certificate purpose, not just subject names or hostnames, so client-auth and mTLS uses are visible before shutdown dates arrive.
- Log the full certificate chain at renewal time Capture the issued chain, intermediate path, and validation result in the renewal event record so trust-store drift can be investigated later.
- Replace manual renewal thresholds with event-driven automation Trigger renewal from certificate state and validity thresholds rather than quarterly calendars, tickets, or runbook reminders.
Bottom line: Shorter TLS validity periods turn certificate management into a continuous control problem rather than a periodic maintenance task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Certificate lifecycle has become an infrastructure control, not a renewal task. Shorter validity periods turn certificate management into a continuous operating discipline because the old slack disappears. Quarterly review cycles, manual approvals, and spreadsheet tracking no longer align with the failure window. The implication is that certificate governance has to be treated like production infrastructure, with state, ownership, and renewal behaviour visible at all times.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between mTLS and client authentication certificates?
A: mTLS is the handshake pattern where both sides authenticate with certificates, while client authentication certificates are the specific certificates presented by the connecting party. In practice, mTLS uses a server certificate plus a client certificate, and the client certificate must carry the correct clientAuth EKU so the peer accepts it for authentication.
👉 Read our full editorial: 45-day TLS certificates make renewal automation unavoidable