This is according to Lauren Courtenay. Manager: Certificate Services at Altron Security, who says Certificate Lifecycle Management (CLM) automation is the only way to keep up with the new certificate renewal requirements.
Transport Layer Security (SSL/TLS) certificates – digital data files that prove the identity of a website or server and enable secure, encrypted connections – were once valid for as long as 398 days. However, the global Certificate Authority/Browser Forum has introduced a phased reduction in the maximum validity period for certificates, reducing it to 200 days in March this year, 100 will be implemented by 15th March 2027, and just 47 days in March 2029.
Courtenay says: “The shrinking certificate lifespan means that organisations must now renew certificates twice a year. By 2029, it will be a monthly task that will drastically increase the workload for IT teams tasked with certificate management.”
She explains that traditional approaches to certificate management are labour-intensive and prone to error. Decentralised certificates can result in ‘rogue’ and forgotten certificates, while manual processes are time-consuming. “If an organisation is following a manual process, they will first need to generate a certificate signing request (CSR) on the server, which contains the domain name you want to secure, the organisation details, and a public key paired with a private key that resides securely on the customer's server. This CSR is then submitted to the Certificate Authority for validation and issuance. Once the certificate is issued, it must be manually installed on the server and paired with the corresponding private key, establishing the secure connection,” she says.
“In addition, many organisations have policies around certificate renewal, so teams carrying out the renewals must ensure they complete the renewal within the specified timeframes. Doing all this work manually - almost monthly - will require more IT resources and higher costs. By March 2029 certificates will be valid for 47 days which means 12 X more work required from IT staff.”
She notes that failing to stay on top of renewals could cause downtime and impact organisations’ brand reputation. “For example, if one expires, a customer-facing website or payment gateway will indicate that the site is not secure,” she says.
Courtenay says many organisations are waiting to see the impact of the shortened certificate lifespans before making a move to automate the process. However, she says they should implement automation sooner rather than later.
“Automation or certification lifecycle management isn’t just a ‘nice to have’ anymore - it’s a necessity. And organisations cannot wait, they have to act soon, to move from reactive to proactive,” she says.
Getting ahead of shrinking certificate lifespans
Altron Security’s Certificate Services team eliminates the challenges of manual certificate management with its Certificate Lifecycle Management services.
The services include discovery to find certificates across the environment, policy enforcement for consistent standards across teams, and auto-renewal or certificate lifecycle management.
Courtenay elaborates: “A discovery scan within the customer’s environment picks up all the organisation's public certificates as well as their internal certificates and rogue certificates, giving the organisation full visibility of every certificate that they have and where they've deployed it, including ones that have been issued and forgotten about. This supports consistent policy enforcement and reduces business risk. In several of our engagements, the discovery scan has proved highly valuable in revealing many forgotten and rogue certificates.”
“After the scan, we look at implementing auto-renewal and auto-installation. That's where certificate lifecycle management comes in. It's a journey that we walk with the customer to ensure they are enforcing the correct policies, and making sure certificates are issued and configured correctly. Automated certificate lifecycle management streamlines processes, ensures best practice and drastically decreases the risk of errors.”
She notes that centralised, automated certificate lifecycle management is crucial for all types of organisations. “It is also useful for mid-tier organisations who want to implement best practices to reduce business risk. We have different certificate lifecycle management (CLM) packages based on the number of certificates you want to automate as well as integration requirements, making our CLM solution more cost effective and budget friendly.”
If your organisation depends on manual processes and lacks visibility of certificates in the environment, learn more about Altron Security Certificate Services.