Automation Alert Sounds as Certificates Set to Expire Faster

The future of managing digital certificates is already here – it’s just not evenly distributed yet.

See Also: What Manufacturing Leaders Are Learning About Cloud Security – from Google’s Frontline

Keen to reduce risks to the web public key infrastructure ecosystem, as well as get the automation ball rolling faster, the industry’s Certification Authority Browser Forum on April 11 approved a motion to reduce the maximum validity of public TLS certificates from 398 days to 47 days.

That TLS Baseline Requirement change, meaning it applies to “authenticating servers accessible through the internet,” will begin in March 2026 and come into full effect in March 2029.

The stakes are high. Digital certificates secure the internet and encrypt communications between browsers and sites by providing the “s” – as in, secure – in HTTPS. Sending payment card data to e-commerce sites, accessing health information from patient portals, reading emails online and much more all rely on trustworthy digital certificates.

Decreasing the validity time for a certificate offers multiple benefits. As previous certificate revocations have demonstrated, actually revoking every bad certificate in a timely manner, across the broad ecosystem, is a challenge. Having certificates simply expire more frequently helps address that.

The CA/Browser Forum also expects an ancillary benefit of “increased consistency of quality, stability and availability of certificate lifecycle management components which enable automated issuance, replacement and rotation of certificates.” While such automation won’t fix every ill, the forum said that “it certainly helps.”

Ingrained Habits

Certificate management too often is still a manual process, a reality in no small part due to three decades of ingrained practices. “Given that it’s incredibly hard to get humans to change the way they do things, once they have a way that ‘works,’ it seems reasonable to assume that most of the certificates issued by these CAs are handled in the same human-centric, error-prone manner they always have been,” said system administrator Matt Palmer in a blog post.

In a study he published last year, Palmer found that CAs such as the newer, non-profit Let’s Encrypt that use the Automatic Certificate Management Environment to issue certificates and also actively encourage their users to use it, have drastically lower rates of compromised certificates.

The takeaway, he said, is clear: “The less humans have to do with certificate issuance, the less likely they are to compromise that certificate by exposing the private key.”

Traditional CAs likewise say that the twin need to manage certificates that expire every 47 days as well as move organizations to post-quantum crypto demands that users automate their processes. “The only way to manage those is going to be with a certificate lifecycle management tool,” said Dean Coclin, senior director at DigiCert’s in an interview late last year with Information Security Media Group.

“This is imperative because the old days of putting calendar reminders in your Outlook and sending alerts to your cell phone or maybe your pager, that is not going to work anymore with these short certificate lifetimes,” said Coclin, who’s the current chair of the CA/Browser Forum.

Cryptographic Agility Required

When it comes to getting the so-called cryptographic agility needed to manage both of those requirements, many organizations say they’re not yet there.

“While awareness is high, execution is lagging,” says a new study from market researcher Omdia. “Many organizations know they need to act but lack clear roadmaps or the internal alignment to do so.”

The study, commissioned by certificate authority Sectigo, formerly known as Comodo, is based on a survey of 272 “IT decision-makers” at mid-size and large organizations around the world, and finds that only about 30% of organizations report that they believe they have a complete, fully updated inventory of all their public SSL/TLS certificates. The rest have a partial inventory, rely on manual methods to track them or simply have no idea how many they might have.

“Perhaps because they have been around for three decades, it’s like TLS certs have kind of been absorbed into the ‘plumbing’ that simply makes IT work, at least in the perception of many of our respondents,” said Rik Turner, the chief analyst for cybersecurity at Omdia. “That’s why it feels like not enough of them are aware of the 47-day issue that’s barreling down the pike towards them, and don’t seem to have thought through the need for automation that it is going to impose on their organization.”

For managing the much shorter certificate renewal timeframe, only 19% of surveyed organizations say they’re “very prepared,” with 40% saying they’re somewhat prepared and another 40% saying they’re not very prepared, and so far continue to rely on manual processes.

“Historically, organizations have been able to get by with poor certificate hygiene because cryptography was largely static,” said Tim Callan, chief compliance officer at Sectigo, and vice chair of the CA/Browser Forum.

Thanks to the upcoming, 47-day maximum period before certificates must expire, as well as the looming need to adopt post-quantum cryptography, “that margin for error is disappearing,” he said.