Certificate Lifetimes Are Collapsing, and Manual Renewal Is Going With Them

The maximum validity period of a publicly trusted TLS certificate has been shrinking for a decade, from several years down to roughly a year, and the agreed direction of travel is shorter still — measured in weeks rather than months. The reasoning is defensible and has not really been contested: certificate revocation has never worked reliably at internet scale, so the practical way to limit the damage of a compromised or mis-issued certificate is to make sure it expires soon regardless. The consequence lands somewhere other than security teams expect. A certificate that lasts a year is renewable by a person with a calendar reminder; it is a chore performed once, by someone who will probably still be in the role next time. A certificate that lasts a few weeks is not. At that cadence, manual renewal stops being a chore and becomes a recurring outage risk, because the failure mode is not gradual — a certificate does not degrade, it works perfectly until the moment it does not, usually at the least convenient hour. Automated issuance and renewal protocols exist, are mature, and are free to use. The difficulty is never the well-behaved web server that someone set up last year with automation in mind. It is the long tail: load balancers configured through a vendor console, internal appliances with a certificate upload form and no API, embedded systems whose firmware expects a file dropped in place, mutual-TLS connections to partners where the other side also has to act, and certificates pinned inside client applications that ship on someone else's release schedule. The realistic preparation is inventory before automation, in that order — a list of every place a certificate is installed, with an owner and a renewal mechanism recorded next to it. Organisations that have done this typically discover the count is higher than anyone estimated and that a meaningful share of entries have no automated path at all. Those entries are the actual project. The shortening deadline is not the problem; it is the thing that converts an old, quietly accumulated inventory gap into a scheduled series of outages.