The shift to shorter SSL/TLS certificate lifecycles is no longer theoretical—it’s happening now. And for many organizations, October 2026 could be the moment where the impact becomes impossible to ignore.
As certificate validity periods shrink, the way organisations manage digital trust must fundamentally change. What was once a routine, annual task is quickly becoming a continuous operational challenge—with real business risk and cost attached.
A Perfect Storm: Shorter Lifecycles, Greater Risk
The industry-wide move toward shorter certificate lifespans is being driven by browser vendors and standards bodies to improve security. By reducing how long certificates are valid, the window for exploitation is significantly limited.
But there’s a trade-off.
On March 15, 2026, the maximum validity for public TLS certificates dropped from 398 days to 200 days—effectively doubling the renewal workload overnight. For organizations still relying on manual processes, spreadsheets, or fragmented tooling, this introduces immediate strain and is both a business and security risk.
And this is only the beginning.
Why October 2026 Matters
Certificates issued under the new 200-day limit will begin expiring around early October 2026. That means a concentrated wave of renewals—many of which organisations may not be fully prepared for.
The risk isn’t just a missed website certificate.
Expired certificates across:
- APIs
- Internal systems
- Cloud workloads
- Third-party integrations
…can lead to outages, failed transactions, compliance breaches, and reputational damage.
For organizations without visibility or automation, identifying and resolving these issues may take hours—or longer.
The Road to 47-Day Certificates
The transition doesn’t stop at 200 days. The roadmap toward shorter lifecycles is already defined:
- March 2026: 200-day certificates
- March 2027: 100-day certificates
- March 2029: 47-day certificates + 10-day domain validation
At 47 days, certificate renewal becomes a monthly requirement—increasing operational demand by up to 12x compared to today.
At that point, manual management isn’t just inefficient—it’s unworkable.
From Certificate Management to Machine Identity Management
This shift is bigger than certificate renewal cycles. It signals a broader evolution toward machine identity management.
Every certificate represents a machine identity—whether it’s securing a website, enabling API communication, or authenticating devices. As environments grow more complex, so does the number of identities that need to be managed, monitored, and secured.
Without centralised visibility, organisations risk:
- Unknown or “rogue” certificates
- Expiry-related outages
- Gaps in compliance
- Increased exposure to security threats
What Organizations Should Be Doing Now
To navigate this transition successfully, organizations need to move from reactive certificate management to a proactive, automated, and strategic approach.
1. Gain Full Visibility
Start with discovery. Identify all certificates across your environment—including shadow IT, legacy systems, and third-party dependencies.
Without visibility, automation is incomplete.
2. Understand Your Environment
Map where certificates are used and which systems they support. Prioritise critical services to ensure business continuity during frequent renewal cycles.
3. Implement Automation
Automation is no longer optional.
Protocols like ACME enable organizations to:
- Automate issuance and renewal
- Reduce human error
- Maintain continuous compliance
- Scale with shorter lifecycles
4. Build a Scalable Operating Model
Short-lived certificates require a shift in how teams operate. This includes:
- Defined ownership of certificate management
- Integrated workflows across IT, DevOps, and Security
- Clear processes for handling exceptions and edge cases
5. Prepare for Crypto-Agility
Shorter lifecycles are also laying the groundwork for the next major shift: post-quantum cryptography (PQC).
Organizations that modernise certificate management today will be better positioned to:
- Transition to quantum-resistant algorithms
- Adapt quickly to future cryptographic changes
- Maintain long-term trust and compliance
The Bottom Line
October 2026 won’t “break the internet”—but it will expose the cracks in how organizations manage certificates today and it will also increase risk for organizations that are not ready/prepared.
Those relying on manual processes will feel the pressure first.
Those investing in visibility, automation, and crypto-agility will be ready.
The move to 47-day certificates is not just a technical change—it’s a forcing function for transformation.
The time to act is now.