{"id":37664,"date":"2026-11-11T10:08:15","date_gmt":"2026-11-11T09:08:15","guid":{"rendered":"https:\/\/sits.com\/?p=37664"},"modified":"2026-11-11T14:56:04","modified_gmt":"2026-11-11T13:56:04","slug":"automating-tls-certificate-renewal","status":"publish","type":"post","link":"https:\/\/sits.com\/en\/blog\/automating-tls-certificate-renewal\/","title":{"rendered":"Automating TLS certificate renewal in the era of 47-day certificate lifetimes"},"content":{"rendered":"

[vc_row custom_background_class=\"gradient-up\"][vc_column]

From 200 to 47 days: How can businesses manage shorter TLS certificate lifetimes efficiently?<\/h2>[vc_column_text]TLS certificates are used in virtually every business. They provide the basis of trust for <\/span>encrypted connections<\/span><\/a> to websites, applications, APIs and digital services. At the same time, the conditions governing their use are changing: the CA\/Browser Forum has decided to gradually reduce the maximum permitted lifetime of publicly trusted TLS certificates. Since <\/span>15 March 2026<\/span><\/b>, the maximum lifetime has been <\/span>200 days<\/span><\/b>. From <\/span>15 March 2027<\/span><\/b>, it will be reduced to <\/span>100 days<\/span><\/b>, and from <\/span>15 March 2029<\/span><\/b> to just <\/span>47 days<\/span><\/b>.<\/span>\u00a0<\/span><\/p>\n

As a result, businesses will need to request certificates, validate domains, deploy new certificates and update existing installations much more often. As lifetimes become shorter, reliably managing certificates using calendar reminders, Excel spreadsheets or manual tickets becomes increasingly difficult. The shorter the lifetimes, the more important <\/span>end-to-end Certificate Lifecycle Management<\/span><\/b> becomes, combining transparency, clear responsibilities and automated processes.<\/span>\u00a0<\/span>[\/vc_column_text]

<\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-down\"][vc_column]

Why shorter TLS certificate lifetimes increase operational risk<\/h2>[vc_column_text]Certificates have always had an expiry date. What has changed is the frequency at which the entire process needs to be repeated. With longer lifetimes, renewing publicly trusted TLS certificates could be treated as a relatively infrequent administrative task in most organisations. The new CA\/Browser Forum requirements change this situation: since 15 March 2026, the maximum lifetime has been 200 days, falling to 100 days from 15 March 2027 and just 47 days from 15 March 2029.<\/span>\u00a0<\/span><\/p>\n

Each reduction increases the number of renewal processes, and every single renewal must also work reliably. If a certificate expires unnoticed, it can result in warnings, connection failures or a service becoming unavailable. <\/span>Certificate management<\/span><\/a> therefore has a direct impact on stable IT operations and affects far more than PKI administrators alone. Depending on the infrastructure, operations, network, platform and application teams may all be involved. They need to ensure that certificates on web servers, load balancers, cloud resources, APIs and applications are replaced correctly and at the right time.<\/span>\u00a0<\/span><\/p>\n

The new limits apply to publicly trusted TLS server certificates. Internal certificates issued by a private enterprise PKI are not directly affected. Nevertheless, it makes sense to include both public and private certificates in an <\/span>overarching certificate lifecycle strategy<\/span><\/a>. This enables businesses to centrally manage inventories, responsibilities and processes. PKI should also be incorporated into the broader security architecture as a <\/span>technical component of Identity & Access Management<\/span><\/a>.<\/span>\u00a0<\/span>[\/vc_column_text]

<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]

Why manual TLS certificate management no longer works<\/h2>[vc_column_text]Many organisations still manage certificates manually or with only partial automation. Expiry dates are recorded in spreadsheets, monitoring systems or calendar entries generate reminders, and new certificates are requested via tickets. Administrators then download the certificates and install them on the relevant target systems.<\/span>\u00a0<\/span><\/p>\n

As long as the number of certificates is small and lifetimes are long, this approach can work. With a maximum validity of 47 days, however, certificates will need to be renewed approximately <\/span>every six to seven weeks from 2029 onwards<\/span><\/b>. An organisation with a larger certificate inventory will therefore need to coordinate a significantly higher number of renewal processes at the same time.<\/span>\u00a0<\/span><\/p>\n

Domain or IP address validation will also become more demanding. From 15 March 2029, previous validation can only be reused for ten days. This means that it is not only the number of certificate renewals that will increase. Validation processes will also need to run reliably at much shorter intervals, because the renewal process does not end when the certificate is issued.<\/span>\u00a0<\/span><\/p>\n

The new certificate must reach the correct target system, be activated together with the complete certificate chain and subsequently undergo technical verification. The existing certificate must be replaced in a controlled manner or revoked where necessary. Without a complete inventory, certificates installed on cloud resources, applications managed on a decentralised basis or poorly documented systems can be overlooked. The more manual handovers there are within this process, the greater the administrative workload and the potential for errors. This also creates a strong dependency on individual employees and their knowledge of the infrastructure.<\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-central\"][vc_column]

<\/div>\n

How to automate TLS certificate renewal with certificate lifecycle management<\/h2>[vc_column_text]A robust solution starts by treating certificate renewal as an end-to-end lifecycle. This extends from inventory and issuance to deployment, renewal, monitoring and revocation.<\/span><\/p>\n

1. Create transparency across the certificate inventory<\/span><\/b><\/h3>\n

The first question is: which certificates actually exist?<\/span>\u00a0<\/span><\/p>\n

For every certificate, businesses should have a central overview of at least its lifetime, issuer, location, status and owner. Only then is it possible to identify which systems are affected by shorter lifetimes and where action is required.<\/span><\/p>\n

2. Standardise rules and certificate processes<\/span><\/b><\/h3>\n

The inventory provides the basis for consistent rules governing issuance, renewal and revocation. Certificate profiles and policies reduce individual exceptions and create repeatable processes.<\/span>\u00a0<\/span><\/p>\n

This also requires responsibilities to be defined: Who owns the certificate? Who is responsible for the associated service? And what happens if an automated renewal fails?<\/span><\/p>\n

3. Automate issuance and renewal<\/span><\/b><\/h3>\n

Where supported by the systems involved, standardised protocols such as ACME or APIs can be used. This allows recurring steps to be automated while reducing manual intervention.<\/span>\u00a0<\/span><\/p>\n

Automation should go beyond issuance alone. Creating a new certificate record within a CA provides little value if the certificate subsequently has to be installed manually across multiple target systems.<\/span><\/p>\n

4. Automatically deploy and validate certificates<\/span><\/b><\/h3>\n

Once issued, the certificate needs to be installed and activated on the designated systems. A technical check should then confirm that the service is actually presenting the new certificate with the correct certificate chain.<\/span>\u00a0<\/span><\/p>\n

Errors at this stage need to be visible and trigger a defined escalation process.<\/span><\/p>\n

5. Integrate monitoring and revocation<\/span><\/b><\/h3>\n

A centralised lifecycle provides continuous transparency regarding status, expiry dates and failed processes. If a certificate is compromised, a system is decommissioned or a certificate can no longer be used for another reason, revocation is also part of the controlled process.<\/span>\u00a0<\/span><\/p>\n

This shifts certificate management from a reactive task shortly before expiry to a continuously controlled operational process.<\/span>[\/vc_column_text]

<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]

Benefits of Automated Certificate Lifecycle Management<\/h2>[vc_column_text]The benefits range from increased availability to improved auditability. <\/span><\/span>They<\/span> can<\/span> be<\/span> summarised<\/span> as <\/span>follows<\/span>:<\/span><\/span>[\/vc_column_text][vc_raw_html]JTNDc3R5bGUlM0UlMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlci1jb2xsYXBzZSUzQSUyMGNvbGxhcHNlJTNCJTBBJTIwJTIwJTIwJTIwd2lkdGglM0ElMjAxMDAlMjUlM0IlMEElMjAlMjAlMjAlMjBmb250LWZhbWlseSUzQSUyMHNhbnMtc2VyaWYlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoJTJDJTBBJTIwJTIwdGFibGUudGhyZWF0LWluZm8tdGFibGUlMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlciUzQSUyMDJweCUyMHNvbGlkJTIwJTIzZmZmZmZmMzMlM0IlMEElMjAlMjAlMjAlMjBwYWRkaW5nJTNBJTIwMjBweCUzQiUwQSUyMCUyMCUyMCUyMGNvbG9yJTNBJTIwJTIzZmZmZmZmJTNCJTBBJTIwJTIwJTIwJTIwdmVydGljYWwtYWxpZ24lM0ElMjB0b3AlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoZWFkJTIwdGglMjAlN0IlMEElMjAlMjAlMjAlMjBiYWNrZ3JvdW5kLWNvbG9yJTNBJTIwJTIzZGVkYzAwJTNCJTBBJTIwJTIwJTIwJTIwY29sb3IlM0ElMjAlMjMwMDAwMDAlM0IlMEElMjAlMjAlMjAlMjBmb250LXdlaWdodCUzQSUyMGJvbGQlM0IlMEElMjAlMjAlMjAlMjB0ZXh0LWFsaWduJTNBJTIwbGVmdCUzQiUwQSUyMCUyMCU3RCUwQSUwQSUyMCUyMHRhYmxlLnRocmVhdC1pbmZvLXRhYmxlJTIwdGJvZHklMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJhY2tncm91bmQtY29sb3IlM0ElMjAlMjMwYzJmNDglM0IlMEElMjAlMjAlN0QlMEElM0MlMkZzdHlsZSUzRSUwQSUwQSUzQ3RhYmxlJTIwY2xhc3MlM0QlMjJ0aHJlYXQtaW5mby10YWJsZSUyMiUzRSUwQSUyMCUyMCUzQ3RoZWFkJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0aCUzRUJlbmVmaXQlM0MlMkZ0aCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RoJTNFSG93JTIwaXMlMjBpdCUyMGFjaGlldmVkJTNGJTNDJTJGdGglM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0aCUzRUJlbmVmaXQlMjBmb3IlMjBidXNpbmVzc2VzJTNDJTJGdGglM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUzQyUyRnRoZWFkJTNFJTBBJTIwJTIwJTNDdGJvZHklM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFSGlnaGVyJTIwYXZhaWxhYmlsaXR5JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUF1dG9tYXRlZCUyMHJlbmV3YWxzJTJDJTIwY29uZmlndXJhYmxlJTIwbGVhZCUyMHRpbWVzJTJDJTIwbW9uaXRvcmluZyUyMGFuZCUyMGVzY2FsYXRpb24lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFUmVkdWNlcyUyMHRoZSUyMHJpc2slMjBvZiUyMHVucGxhbm5lZCUyMHNlcnZpY2UlMjBvdXRhZ2VzJTIwY2F1c2VkJTIwYnklMjBleHBpcmVkJTIwY2VydGlmaWNhdGVzLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFTGVzcyUyMG1hbnVhbCUyMG9wZXJhdGlvbmFsJTIwZWZmb3J0JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVJ1bGUtYmFzZWQlMjB3b3JrZmxvd3MlMkMlMjBBQ01FJTJDJTIwQVBJcyUyMGFuZCUyMHRoZSUyMGludGVncmF0aW9uJTIwb2YlMjBjZXJ0aWZpY2F0ZSUyMGF1dGhvcml0aWVzJTIwYW5kJTIwdGFyZ2V0JTIwc3lzdGVtcyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VMYXJnZXIlMjBjZXJ0aWZpY2F0ZSUyMGludmVudG9yaWVzJTIwY2FuJTIwYmUlMjBtYW5hZ2VkJTIwd2l0aG91dCUyMHN0YWZmaW5nJTIwcmVxdWlyZW1lbnRzJTIwaW5jcmVhc2luZyUyMGluJTIwcHJvcG9ydGlvbiUyMHRvJTIwcmVuZXdhbCUyMGZyZXF1ZW5jeS4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUNlbnRyYWxpc2VkJTIwdHJhbnNwYXJlbmN5JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUludmVudG9yeSUyQyUyMHNlYXJjaCUyMGZ1bmN0aW9uYWxpdHklMkMlMjBtb25pdG9yaW5nJTJDJTIwZGFzaGJvYXJkcyUyMGFuZCUyMHJlcG9ydHMlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQ3JpdGljYWwlMjBjZXJ0aWZpY2F0ZXMlMjBjYW4lMjBiZSUyMGlkZW50aWZpZWQlMjBlYXJseSUyMGFuZCUyMHByaW9yaXRpc2VkJTIwYWNjb3JkaW5nbHkuJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VDb25zaXN0ZW50JTIwc2VjdXJpdHklMjBwb2xpY2llcyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VDZW50cmFsJTIwY2VydGlmaWNhdGUlMjBwcm9maWxlcyUyQyUyMHBvbGljaWVzJTJDJTIwcm9sZS1iYXNlZCUyMHByb2Nlc3NlcyUyMGFuZCUyMGRlZmluZWQlMjBzZWN1cml0eSUyMGxldmVscyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VSZWR1Y2VzJTIwbWlzY29uZmlndXJhdGlvbnMlMjBhbmQlMjB1bmNvbnRyb2xsZWQlMjBleGNlcHRpb25zLiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFSW1wcm92ZWQlMjBhdWRpdGFiaWxpdHklM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFRG9jdW1lbnRlZCUyMGlzc3VhbmNlJTJDJTIwcmVuZXdhbCUyQyUyMHJldm9jYXRpb24lMjBhbmQlMjBhZG1pbmlzdHJhdGl2ZSUyMGludGVydmVudGlvbnMlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFSW50ZXJuYWwlMjBhbmQlMjBleHRlcm5hbCUyMGF1ZGl0b3JzJTIwcmVjZWl2ZSUyMHRyYWNlYWJsZSUyMGluZm9ybWF0aW9uJTIwYWJvdXQlMjBjZXJ0aWZpY2F0ZSUyMHByb2Nlc3NlcyUyMGFuZCUyMHJpc2slMjBjb250cm9scy4lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTNDJTJGdGJvZHklM0UlMEElM0MlMkZ0YWJsZSUzRQ==[\/vc_raw_html]
<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]

Certificate Lifecycle Management use cases<\/h2>[vc_column_text]The challenges vary depending on the infrastructure. Three scenarios illustrate how Certificate Lifecycle Management can be applied in practice.<\/span>\u00a0<\/span><\/p>\n

Publicly accessible websites, customer portals and APIs<\/span><\/b>\u00a0<\/span><\/h3>\n

A business operates several public web applications and APIs via web servers and load balancers. The publicly trusted TLS certificates used for these services will need to be replaced at much shorter intervals in future.<\/span>\u00a0<\/span><\/p>\n

An automated process identifies upcoming expiry dates, requests a new certificate, performs the required domain validation and distributes the certificate to the affected systems. After deployment, the process verifies that the service is accessible and uses the correct certificate.<\/span>\u00a0<\/span><\/p>\n

Hybrid IT and cloud infrastructure<\/span><\/b>\u00a0<\/span><\/h3>\n

In hybrid environments, certificates can be located in on-premises data centres, cloud platforms, reverse proxies and containerised applications. Without a shared overview, entries may be recorded twice or overlooked entirely.<\/span>\u00a0<\/span><\/p>\n

A centralised lifecycle consolidates inventories, assigns responsibilities and connects different target systems via appropriate interfaces. This creates a common management layer across technically diverse environments.<\/span>\u00a0<\/span><\/p>\n

Public administration and critical infrastructure<\/span><\/b>\u00a0<\/span><\/h3>\n

Business-critical services combine stringent requirements for availability and traceability. With manual management, short certificate lifetimes would require repeated operational intervention. Automated renewals, documented approvals and reporting reduce manual touchpoints while ensuring transparent processes.<\/span>[\/vc_column_text]

<\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]

How to implement automated TLS certificate renewal<\/h2>[vc_column_text]The process should begin with a structured inventory. Automating individual certificates immediately without first understanding the certificate landscape, responsibilities and processes only solves part of the problem.<\/span><\/p>\n

1. Define the scope<\/span><\/b><\/h3>\n

The first step is to establish which certificate types and environments will be included. A clear distinction between publicly trusted TLS certificates and internal certificates issued by the enterprise PKI is useful.<\/span><\/p>\n

2. Create a Certificate Inventory<\/span><\/b><\/h3>\n

Known certificate sources, CAs and target systems should be consolidated in an inventory. Companies should also actively search for certificates that have been created outside documented processes.<\/span><\/p>\n

3. Define owners and criticality<\/span><\/b><\/h3>\n

Every certificate needs a technical owner and, where appropriate, a business owner. The associated services should also be assessed according to criticality, public accessibility and the potential impact of an outage.<\/span><\/p>\n

4. Standardise the entire lifecycle<\/span><\/b><\/h3>\n

Request, approval, issuance, distribution, renewal and revocation should be defined as a connected process. Any necessary exceptions require documented procedures with clearly defined time limits.<\/span><\/p>\n

5. Prioritise automation<\/span><\/b><\/h3>\n

Publicly accessible, business-critical certificates or those requiring regular renewal are suitable starting points. Systems without an appropriate interface require an alternative controlled process.<\/span><\/p>\n

6. Pilot, test failure scenarios and roll out<\/span><\/b><\/h3>\n

Rather than moving the entire environment at once, businesses should start with a pilot project involving a manageable number of representative systems. Testing should not be limited to successful renewal. Failed validation, an unavailable target system or an incorrect certificate chain should also be covered.<\/span>\u00a0<\/span>[\/vc_column_text]

<\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-up\"][vc_column]

How to choose a Certificate Lifecycle Management solution<\/h2>[vc_column_text]A suitable platform should do more than issue warnings about upcoming expiry dates. What matters is how much of the entire lifecycle it can actually manage and automate.<\/span>\u00a0<\/span><\/p>\n

The following questions can help when evaluating a solution:<\/span>\u00a0<\/span><\/p>\n