Certificate management has traditionally been treated as a routine IT responsibility. For many organisations, it involves tracking expiry dates and renewing certificates before they cause problems. But that approach is becoming increasingly difficult to sustain.
With certificate validity periods getting shorter, organisations will soon need to manage renewals far more frequently than before. What was once a relatively straightforward administrative task is becoming an important part of maintaining operational resilience.
The transition is already underway. Under the CA/Browser Forum's updated requirements, the maximum validity period for publicly trusted TLS certificates fell to 200 days on 15 March 2026. It will reduce further to 100 days on 15 March 2027, before reaching just 47 days on 15 March 2029. The rules also introduce shorter reuse periods for domain and IP address validation data. This means organisations will need to validate certificate information more frequently as well.
These changes are intended to improve the reliability of certificate information and reduce the risks associated with outdated credentials. They also support greater automation and make it easier for the industry to adopt new cryptographic standards. For businesses, however, the immediate concern is operational. Certificate renewals will become a continuous responsibility rather than something that can be managed periodically. Organisations that continue to rely on manual processes may find themselves struggling to keep pace.
The impact of shorter certificate lifespans is easy to underestimate. A reduction from 398 days to 200 days may appear manageable on paper. But the operational burden increases significantly as validity periods continue to shrink.
Compared with the previous 398-day maximum, the approximate renewal frequency for a continuously maintained certificate will change as follows:
These figures represent a substantial increase in work for organisations managing large certificate inventories. A business responsible for thousands of certificates will need to handle renewals throughout the year. Each renewal may involve confirming ownership and completing validation checks. Certificates must then be deployed correctly and tested to ensure that critical services continue to function.
Spreadsheets and manual reminders are not designed to manage this level of activity. They may help teams maintain an inventory, but they cannot reliably coordinate the entire renewal process. They also provide limited protection against missed deadlines or unclear responsibilities.
The problem becomes particularly serious when certificates support business-critical applications. A single expired certificate can interrupt access to an online service or prevent systems from communicating. It can also affect customer-facing platforms. As renewal intervals become shorter, the opportunity for such failures increases unless organisations change how certificates are managed.
One of the biggest mistakes organisations can make is viewing certificates purely as technical assets. Their importance extends well beyond the IT department. Certificates support secure connections between systems and help establish trust in digital services. When they expire unexpectedly, the consequences can affect business operations directly.
Under the previous 398-day validity period, many organisations could manage certificates through a combination of manual tracking and individual expertise. Security teams often depended on experienced employees who knew which certificates were approaching expiry and which applications required special attention. Ownership was not always clearly documented. Different departments sometimes used separate tools and processes.
Although this approach was inefficient, the relatively long renewal cycle gave teams more time to identify problems and correct them.
The move to 100-day certificates changes that situation considerably. There will be less time to recover from missed renewals or resolve problems with certificate deployment. Organisations that depend on manual coordination may find that the same weaknesses begin to cause repeated operational disruptions.
The main issue is not simply knowing when certificates expire. It is having a reliable process that ensures renewals happen correctly every time. This is why investments in certificate lifecycle automation made during 2026 will become particularly valuable in 2027. The benefits will extend beyond reducing administrative work. They will help organisations maintain service availability as renewal requirements become more demanding.
The first reduction to 200-day certificates took effect in March 2026. For many organisations, this has created additional work without necessarily causing immediate disruption. Teams may still be able to manage renewals through existing processes by spending more time on coordination and monitoring. That apparent stability can be misleading.
An organisation that has managed the 200-day requirement without major problems may assume it can wait until 2027 before investing in automation. But the next reduction is approaching quickly. Preparing for it involves considerably more than purchasing certificate management software.
Organisations need time to understand their existing certificate environments and establish clear responsibilities. They must also identify where manual processes can be replaced with automation.
The most important activities include:
These activities require coordination between security teams and the departments responsible for business applications. They may also involve changes to existing infrastructure and deployment processes.
Organisations that began investing in automation earlier in 2026 have had more time to test their systems and address implementation challenges. Those that have not yet started should prioritise the most critical services before the March 2027 deadline. Waiting until certificates are already limited to 100 days could create unnecessary pressure. Teams may be forced to implement new processes while simultaneously managing a much higher volume of renewals.
The resulting costs may not appear under a dedicated certificate management budget. Instead, they may emerge through emergency procurement or additional staff hours. Failed deployments could require urgent intervention. Senior technical personnel may also need to divert attention away from other important security initiatives. The purpose of preparing early is to avoid these problems before they affect normal business operations.
Certificate lifecycle automation is often presented as a technical improvement. However, the financial implications are equally important. Manual certificate management consumes valuable staff time. Infrastructure teams must identify certificate owners and coordinate renewals. Security personnel need to monitor expiry dates and investigate potential issues. Senior architects may become involved when certificates support complex applications or require changes to existing systems.
Individually, these activities may appear relatively minor. Across a large organisation, however, they can account for a considerable amount of work. The cost becomes more significant when experienced technical staff are repeatedly involved in routine administrative tasks. Time spent managing certificates manually is time that cannot be dedicated to improving security architecture or addressing other business priorities.
Automation helps reduce this burden by introducing a consistent process for certificate management. Solutions from providers such as Keyfactor can help organisations automate certificate renewals and gain better visibility over their certificate infrastructure. Rather than depending on individual employees to track renewals, organisations can use automated workflows to identify certificates approaching expiry and initiate the necessary actions. Certificate discovery can also help uncover assets that are not included in existing inventories. This reduces the amount of manual coordination required for routine renewals. It also makes the process less dependent on employees remembering specific procedures or maintaining their own records.
The financial value of automation comes from reducing recurring operational effort while lowering the likelihood of certificate-related disruption. This becomes increasingly important as certificate lifespans continue to shorten. A process that is manageable with 200-day certificates may become expensive and unreliable when the validity period falls to 100 days.
The challenge will grow further when the 47-day requirement takes effect in 2029.
For enterprise architecture teams, certificate lifecycle management must therefore be considered part of the organisation's wider technology infrastructure. It affects how applications are deployed and maintained. It also influences service availability and the effectiveness of operational security controls. Where certificates are managed by multiple departments, the organisation needs a common approach. Allowing every team to develop its own renewal procedures can create inconsistencies that become difficult to control at scale.
Investment should therefore focus on establishing a reliable operating model rather than simply introducing another security tool. A centralised certificate inventory is an important starting point. Organisations also need documented ownership and standard renewal procedures. Automated workflows should be supported by monitoring that identifies failures and alerts the appropriate teams.
Management reporting is equally valuable. It should provide visibility into renewal coverage and unresolved exceptions. It should also help security leaders understand whether critical certificates are being managed effectively. Implementation does not need to happen across the entire organisation at once. A practical approach is to begin with systems that have large certificate volumes and relatively straightforward renewal requirements.
Teams can establish reliable automation for these environments before extending the process to more complex applications. This allows organisations to identify integration problems and refine their procedures without introducing unnecessary risk to critical services. The objective should be to make certificate renewals a predictable part of normal operations before the 100-day requirement takes effect.
The return on investment will not necessarily be reflected in fewer support tickets immediately. Its greater value will become apparent when organisations can manage more frequent renewals without increasing their operational workload at the same rate.
For organisations reviewing their cybersecurity priorities, the move towards shorter certificate lifespans should also prompt a wider discussion about operational resilience. Digital certificates play an important role in maintaining secure access to applications and services. A certificate failure can therefore become a business continuity issue, particularly when it affects systems that employees or customers depend on.
The consequences may extend beyond temporary inconvenience. An expired certificate can interrupt essential business processes. It may also prevent automated services from communicating with one another. Organisations should consider these scenarios as part of their wider incident response planning. This includes identifying which critical services depend on digital certificates and understanding how quickly those services could be restored following a certificate-related failure. It is also important to establish clear escalation procedures. Teams should know who is responsible for investigating a failed renewal and who has authority to approve emergency changes.
At Cyber Management Alliance (CM-Alliance), we help organisations strengthen their ability to respond to cyber incidents and operational disruptions through specialist Cyber Tabletop Exercises and Cyber Incident Planning and Response Training. These exercises can help organisations assess how effectively their teams would respond to incidents affecting critical services. They also provide an opportunity to identify weaknesses in communication and escalation procedures before a real disruption occurs.
Certificate automation addresses an important operational risk. However, organisations must also be prepared for situations where automated processes fail or critical infrastructure becomes unavailable. Combining effective certificate management with tested incident response procedures can help reduce the business impact of these events.
The move to 100-day TLS certificates in March 2027 is not simply another technical compliance deadline. It represents a significant change in how organisations will need to manage digital certificates. For years, relatively long certificate validity periods allowed businesses to depend on manual tracking and periodic renewals. That approach is becoming increasingly difficult to justify.
As certificate lifespans fall to 100 days and eventually 47 days, organisations will need processes that can handle frequent renewals without creating additional operational risk. The organisations that invested in automation during 2026 will enter 2027 with an important advantage. They will have had time to establish ownership and test automated workflows. They will also be better prepared to manage certificate renewals as part of their normal operations. Those that delay may find themselves implementing new systems under considerable time pressure.
The real issue is not the number of days a certificate remains valid. It is whether an organisation can manage the renewal process reliably as those periods continue to shorten.
Certificate lifecycle automation is becoming a necessary part of maintaining secure and resilient digital operations. Organisations that address it now will be better prepared for the changes taking effect in 2027 and the further reduction scheduled for 2029.