For leaders

The certificate deadline: vendors are racing it. Are you?

King Technology Solutions | October 2026 | 5-minute read

What changed · How the market is responding · Five decisions · Where to start · Sources

Every public website, API and remote-access portal depends on a certificate, and the industry has agreed to make those certificates expire far faster. The vendors who sell certificates and certificate tools have spent the past year rebuilding their products around that deadline. Most of the customers they serve have not finished the same work.

What changed, in one paragraph

In April 2025 the CA/Browser Forum (the certificate authorities and the browser makers) voted to cut the maximum lifetime of public TLS certificates from 398 days to 47 days in three steps, and to cut how long domain validation can be reused from 398 days to 10 days. The first step took effect March 15, 2026; the first 200-day certificates began expiring in early October 2026. The vote: certificate issuers 25 yes, 0 no, 5 abstain; browser makers 4 yes, 0 no.

How the market is responding

This is a summary of public announcements so you can see the direction of the market. King Tech is vendor-neutral: we don’t resell or recommend any of these products, and inclusion is not an endorsement.

• AppViewX

  Its November 2025 release of the AVX ONE platform added automated renewal and re-enrollment for short-lived certificates and a cryptographic bill of materials. Its Summer 2026 release added policy-driven renewal across groups of certificates and certificate authorities.

• DigiCert

  Reported in October 2026 that annual recurring revenue for its Trust Lifecycle Manager rose 38% year on year, driven by demand for automated certificate management, and that some enterprises now hold more than 100,000 certificates.

• Let’s Encrypt

  The free certificate authority is moving its default certificates from 90 days to 64 days in February 2027 and 45 days in February 2028. It tells users to automate renewals, use ACME Renewal Information (ARI) and monitor for renewals that don’t happen.

• Sectigo

  In September 2026 warned that the first 200-day certificates are now expiring and that renewal work that used to come once a year now comes about twice a year.

The pattern is the same everywhere: discovery, automation, and policy applied to groups of certificates instead of one at a time. The tools are ready earlier than most organizations are.

Five decisions that belong to leadership

1. Who owns certificates? Today it is often nobody, or whoever bought the last one. Name one accountable owner and an owner for each certificate.
2. Build on free automation, buy a platform, or both? Open standards (ACME) cover many web servers at little cost; large or mixed estates usually need a management platform. Decide by inventory size and how many systems can’t automate, not by brand.
3. What do we do about systems that can’t automate? Older appliances, plant and lab systems and some vendor products may need upgrades, private certificates or an accepted, documented risk.
4. Public or private certificates for internal systems? The schedule applies to publicly trusted certificates; internal systems can often use a private certificate authority with policies you set. That is a policy decision with security trade-offs.
5. What do we require from our vendors? Make automated certificate renewal (ACME or an API) a buying requirement for appliances, SaaS and managed services from now on.

Where to start this quarter

• Get an inventory you trust (only 34% of organizations say theirs is complete and current; DigiCert 2026 Global PKI Research via IT Brief UK, Oct 2026, vendor research).
• Alert on expiry and on failed renewals, routed to the owner.
• Plan for March 15, 2027 (100 days), not 2029.

Want to know where you stand? Take the readiness check →

Sources

Facts checked Oct 13, 2026.

Vendor announcements are as published by the vendors and reporters named. King Tech is independent and is not affiliated with any of them.

Are we CLM compliant yet? →