In Brief (TL;DR)
The reduction in TLS certificate lifetimes from 398 days to 200 days, and eventually to just 47 days, is not simply a certificate management challenge. It is a machine identity security challenge. Organizations that still rely on manual renewal processes, fragmented ownership, and limited visibility into their certificate estate will struggle to keep pace with the new operational reality. Success will depend on adopting automated certificate lifecycle management, establishing clear ownership, maintaining continuous visibility over machine identities, and developing the agility to rapidly replace credentials when trust, policy, or cryptographic requirements change. In short, the certificate is not the problem. The old operating model is.
The first deadline has already passed, yet many organizations are still treating certificate lifetime reductions as a future problem.
On March 15, 2026, the maximum validity of publicly trusted TLS certificates dropped to 200 days. It will fall again to 100 days in 2027 and then to just 47 days in 2029.
Many security teams see this as a certificate management issue.
It's not.
It's a machine identity security issue.
The Certificate Isn't the Problem
A certificate is simply an identity credential. It allows browsers, applications, APIs, workloads, and devices to trust the system presenting that identity.
When a certificate expires unexpectedly, the impact is rarely technical. Businesses experience:
Service outages
Failed customer transactions
Broken APIs
Deployment failures
Application downtime
Shorter certificate lifetimes improve security by reducing the exposure window for outdated identity information and compromised keys.
But they also expose weaknesses that many organizations have tolerated for years.
The move to shorter certificate lifetimes isn't testing your PKI. It's testing your machine identity operating model.
Why Manual Certificate Management No Longer Works
Organizations that rely on spreadsheets, calendar reminders, change tickets, and manual certificate installation face a simple reality: the numbers no longer add up.
An organization managing 10,000 public certificates could see lifecycle events increase dramatically as validity periods continue to shrink.
The issue isn't the exact volume.
The issue is that a process that struggled once a year won't suddenly become reliable when it needs to happen several times more often.
The 200-day rule didn't create the problem.
It revealed it.
Visibility Is More Important Than Certificate Count
Many organizations believe they understand their certificate estate because they have reports from a certificate authority, cloud platform, or load balancer.
That isn't true visibility.
Effective machine identity security requires organizations to understand:
- Which applications depend on each certificate
- Who owns those services
- Where private keys are stored
- Whether certificates can be renewed automatically
- How quickly credentials can be replaced following compromise
Without ownership and dependency context, an expiration date is simply a countdown timer.
An inventory tells you what exists. Machine identity security tells you what matters.
Deployment Is Often the Biggest Risk
Modern certificate authorities can issue certificates in minutes.
Deployment is far harder.
Security teams must ensure certificates are correctly installed across:
- Web servers and applications
- API gateways
- Load balancers
- Cloud services
- Kubernetes environments
- IoT and OT systems
Legacy infrastructure
Automating issuance without automating deployment solves only part of the problem.
Organizations need confidence that every endpoint receives the correct certificate and that changes are verified after deployment.
Machine Identity Requires Clear Ownership
One of the most common causes of certificate-related outages is confusion over responsibility.
The PKI team may manage the certificate authority.
The application team owns the service.
The network team manages the load balancer.
A vendor performs deployment.
Everyone assumes someone else owns renewal.
Until something expires.
Every machine identity should have:
- A defined owner
- An accountable team
- A documented business purpose
- A managed lifecycle
Machine identities should be governed with the same discipline organizations apply to privileged human identities.
Beyond Expired Certificates
Expiration is only one machine identity risk.
Other challenges include:
Unknown Private Keys
Organizations often know where certificates exist but not where associated keys have been copied or stored.
Shared Certificates
A single certificate may be deployed across multiple systems, creating significant operational risk if replacement becomes necessary.
Orphaned Identities
Certificates frequently remain active long after applications, services, or owners have disappeared.
Uncontrolled Issuance
Different teams may create certificates through separate processes, making governance and compliance difficult.
These risks often remain hidden until a security incident or outage occurs.
Building a Modern Machine Identity Security Strategy
The answer is not another spreadsheet.
Nor is it simply purchasing a certificate lifecycle management tool.
Organizations need a machine identity operating model built around automation and governance.
A mature approach includes:
- Continuous certificate discovery
- Centralized inventory and ownership tracking
- Policy-driven issuance
- Automated enrollment and renewal
- Automated deployment
- Secure private key management
- Continuous monitoring and validation
- Rapid replacement capabilities
The objective is not to renew certificates faster. The objective is to make machine trust observable, governable, and replaceable.
Why This Matters for Post-Quantum Readiness
Shorter certificate lifetimes and post-quantum cryptography are often discussed together.
They are not the same thing.
Reducing certificate validity does not make cryptography quantum-safe.
However, organizations that can rapidly discover, replace, and redeploy certificates are far better positioned to migrate cryptographic algorithms when the time comes.
Certificate lifecycle automation is not a post-quantum strategy.
It is one of the prerequisites for executing one successfully.
What Leaders Should Be Asking
Security and technology leaders should already know:
- Do we have a complete inventory of machine identities?
- Can every certificate be linked to an owner?
- What percentage of lifecycle management is automated?
- Which critical services still require manual deployment?
- Can we replace compromised certificates within 24 hours?
- Do we control certificate issuance across the organization?
- Are we prepared for future cryptographic changes?
If the answer to several of these questions is "no," the challenge isn't certificate validity.
It's machine identity governance.
Final Thought
The move to 200-day, 100-day, and eventually 47-day TLS certificates is not forcing organizations to rethink certificate management.
It's forcing them to rethink how machine identities are managed across the enterprise.
Organizations shouldn't ask how to make their existing renewal processes run more frequently.
They should ask why machine identities are still being managed through processes that would never be considered acceptable for human privileged access.
The certificate is not expiring.
The old operating model is.
Ready to make AI Accountable?
Build governance into every agent identity.
Frequently asked questions
What is machine identity security?
Machine identity security focuses on managing and protecting the digital identities used by applications, workloads, APIs, devices, containers, and services, including certificates, secrets, and cryptographic keys.
Why are TLS certificate validity periods getting shorter?
The industry is reducing certificate lifetimes to ensure identity information remains accurate and to reduce the impact of compromised or outdated credentials.
How do shorter certificate lifetimes affect organizations?
They increase the frequency of certificate renewals and expose weaknesses in manual certificate management processes, making automation essential.
What is certificate lifecycle management (CLM)?
Certificate lifecycle management is the process of discovering, issuing, deploying, monitoring, renewing, and replacing certificates throughout their lifecycle.
How does machine identity security support post-quantum readiness?
Organizations that can automate discovery, issuance, deployment, and replacement of certificates are better prepared to migrate to new cryptographic algorithms when post-quantum standards become widely adopted.
