As TLS/SSL certificate lifespans shrink, manual management reaches its limit

 By Lauren Courtenay, Manager Certificate Services

The task of managing TLS/SSL certificates manually is set to grow increasingly onerous over the next three years, with certificate lifespans shrinking and the frequency of renewals increasing sharply. For organisations with hundreds or even thousands of certificates, the workload could soon become unmanageable.

This is according to Lauren Courtenay. Manager: Certificate Services at Altron Security, who says Certificate Lifecycle Management (CLM) automation is the only way to keep up with the new certificate renewal requirements.

Transport Layer Security (SSL/TLS) certificates – digital data files that prove the identity of a website or server and enable secure, encrypted connections – were once valid for as long as 398 days. However, the global Certificate Authority/Browser Forum has introduced a phased reduction in the maximum validity period for certificates, reducing it to 200 days in March this year, 100 will be implemented by 15^th March 2027, and just 47 days in March 2029.

Courtenay says: “The shrinking certificate lifespan means that organisations must now renew certificates twice a year. By 2029, it will be a monthly task that will drastically increase the workload for IT teams tasked with certificate management.”

She explains that traditional approaches to certificate management are labour-intensive and prone to error. Decentralised certificates can result in ‘rogue’ and forgotten certificates, while manual processes are time-consuming. “If an organisation is following a manual process, they will first need to generate a certificate signing request (CSR) on the server, which contains the domain name you want to secure, the organisation details, and a public key paired with a private key that resides securely on the customer's server. This CSR is then submitted to the Certificate Authority for validation and issuance. Once the certificate is issued, it must be manually installed on the server and paired with the corresponding private key, establishing the secure connection,” she says.

“In addition, many organisations have policies around certificate renewal, so teams carrying out the renewals must ensure they complete the renewal within the specified timeframes. Doing all this work manually - almost monthly - will require more IT resources and higher costs. By March 2029 certificates will be valid for 47 days which means 12 X more work required from IT staff.”

She notes that failing to stay on top of renewals could cause downtime and impact organisations’ brand reputation. “For example, if one expires, a customer-facing website or payment gateway will indicate that the site is not secure,” she says.

Courtenay says many organisations are waiting to see the impact of the shortened certificate lifespans before making a move to automate the process. However, she says they should implement automation sooner rather than later.

“Automation or certification lifecycle management isn’t just a ‘nice to have’ anymore - it’s a necessity. And organisations cannot wait, they have to act soon, to move from reactive to proactive,” she says.

Getting ahead of shrinking certificate lifespans

Altron Security’s Certificate Services team eliminates the challenges of manual certificate management with its Certificate Lifecycle Management services.

The services include discovery to find certificates across the environment, policy enforcement for consistent standards across teams, and auto-renewal or certificate lifecycle management.

Courtenay elaborates: “A discovery scan within the customer’s environment picks up all the organisation's public certificates as well as their internal certificates and rogue certificates, giving the organisation full visibility of every certificate that they have and where they've deployed it, including ones that have been issued and forgotten about. This supports consistent policy enforcement and reduces business risk. In several of our engagements, the discovery scan has proved highly valuable in revealing many forgotten and rogue certificates.”

“After the scan, we look at implementing auto-renewal and auto-installation. That's where certificate lifecycle management comes in. It's a journey that we walk with the customer to ensure they are enforcing the correct policies, and making sure certificates are issued and configured correctly. Automated certificate lifecycle management streamlines processes, ensures best practice and drastically decreases the risk of errors.”

She notes that centralised, automated certificate lifecycle management is crucial for all types of organisations. “It is also useful for mid-tier organisations who want to implement best practices to reduce business risk. We have different certificate lifecycle management (CLM) packages based on the number of certificates you want to automate as well as integration requirements, making our CLM solution more cost effective and budget friendly.”

If your organisation depends on manual processes and lacks visibility of certificates in the environment, learn more about Altron Security Certificate Services.

How much shorter are TLS/SSL certificate lifespans getting?

Certificates were once valid for up to 398 days. The global Certificate Authority/Browser Forum has been reducing that maximum in stages: to 200 days from March 2026, to 100 days by 15 March 2027, and to 47 days by March 2029.

Why is manual certificate management becoming harder? 

Shorter lifespans mean more frequent renewals. Organisations that renew certificates twice a year today will be renewing monthly by 2029. Each renewal involves generating a certificate signing request, getting the certificate issued, and installing it on the server by hand, which is slow and open to error. At 47 days, Altron Security’s Lauren Courtenay estimates IT teams will face about 12 times the current workload. 

What does Certificate Lifecycle Management (CLM) cover? 

 Altron Security’s CLM services cover three areas: discovery to find every certificate in your environment, policy enforcement so teams apply consistent standards, and auto-renewal and auto-installation. We work with each customer to make sure the right policies are in place and certificates are issued and configured correctly. CLM packages are priced by the number of certificates you automate and your integration requirements, so they suit mid-tier organisations as well as larger enterprises. 

What does a discovery scan find? 

 A discovery scan maps your public and internal certificates, along with any rogue certificates, and shows where each one is deployed. This includes certificates that were issued and then forgotten. Full visibility gives you a basis for consistent policy enforcement and lower business risk. In several Altron Security engagements, the scan has uncovered forgotten and rogue certificates. 

What happens if a certificate expires, and should we wait before automating? 

 An expired certificate can cause downtime. A customer-facing website or payment gateway will show that the site is not secure, which can damage your brand’s reputation. Courtenay recommends acting now rather than waiting to see the effect of shorter lifespans, so your organisation can move from reactive to proactive certificate management. Learn more about Altron Security Certificate Services.