Topic starter
06/11/2026 6:55 pm
TL;DR: Certificate validity is shrinking to 47 days by 2029, according to AppViewX's analysis of the change. Practitioners will need continuous inventory and automated renewal because manual certificate handling will no longer scale.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “Preparing Your Business for Shorter Certificate Lifetimes”.
By the numbers:
- The first reduction took effect in March 2026.
- The endpoint is 47 days, down from 398.
Key questions
Q: Why do expired certificates still cause outages in mature environments?
A: Expired certificates still cause outages because many environments rely on manual tracking, fragmented ownership, and renewal processes that do not match certificate growth.
Q: How should organisations automate certificate renewal without losing control?
A: Automate the predictable parts of renewal, especially for low-risk certificates with repeatable trust paths, and keep human review for exceptions and high-impact systems.
Q: How should teams inventory machine certificates in hybrid environments?
A: Inventory machine certificates by binding each certificate to its owning workload, service account, or device, then record issuer, subject, serial number, key location, expiry, and renewal path across on-premises and cloud platforms.
Practitioner guidance
- Build a complete certificate inventory Track every certificate across web, application, cloud and internal services, with expiry date, owner and deployment location.
- Automate renewal before 100-day deadlines Remove manual approvals, file uploads and one-off renewals from the path so routine certificate replacement runs without a person intervening.
- Assign ownership for every certificate Make one team accountable for each certificate so reorgs, retirements and cloud sprawl do not leave assets orphaned.
Bottom line: Shorter certificate lifetimes turn lifecycle governance into an always-on operational requirement, not a yearly maintenance task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Certificate lifecycle has become a governance discipline, not a renewal chore. Shorter validity periods force ownership, discovery and automation into the same control plane because ad hoc renewal no longer scales. The organisations that treat certificates as governed infrastructure will absorb the change; those that treat them as tickets will absorb outages. The practical conclusion is that lifecycle ownership now matters as much as cryptographic strength.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams respond to shorter certificate lifespans?
A: They should treat shorter lifespans as an automation mandate, not as a reason to add more manual review. The immediate priority is to inventory all machine identities, remove ticket-driven renewals, and enforce policy-based issuance and revocation. That approach reduces outages and creates a foundation for broader lifecycle governance.
👉 Read our full editorial: 47-day certificate lifetimes force always-on PKI governance