KING TECHNOLOGYSolutions Group

Security

CERTIFICATE LIFECYCLE MANAGEMENT

Are we CLM compliant yet?

Where things stand · Why leadership · Readiness check · Two-week project · Sources

Public certificate lifetimes are being cut on a fixed schedule: 200 days now, 100 days in March 2027, 47 days in March 2029. Nobody audits you for this. Certificates that are not renewed in time simply stop being trusted, and the service behind them goes dark. Being “compliant” means every certificate renews itself before the next cut.

Where things stand

In force now

200-day maximum since March 15, 2026. The first 200-day certificates began expiring in early October 2026.

Next cut

100 days on March 15, 2027.

By 2029

47-day certificates, and domain validation that can be reused for only 10 days.

The rule applies to publicly trusted TLS server certificates. Certificates from an organization’s own private certificate authority are not covered by it.

Why this lands on leadership’s desk

Renewals multiply

At 47 days, each certificate renews about eight times a year instead of once. Manual renewal stops being a chore and becomes impossible at scale.

Outages are already common

72%

of organizations had at least one certificate-related outage in the previous year.

Most can’t see all their certificates

34%

of organizations have a complete, current inventory of their digital certificates.

32%

of organizations have inventoried their cryptographic assets.

Analysts expect manual renewal to fail

A Gartner analyst said most organizations can’t handle manual renewals at a 47-day cycle, and some will struggle even at 100 days.

Several of these figures come from surveys run by certificate and security vendors. We show them because they are the best published numbers, and we label them so you can weigh them.

TechTarget’s July 2026 guidance for security leaders: inventory certificates and cryptographic assets and link each to its business service and owner, automate certificate lifecycle management, and build crypto-agility.

Take the 2-minute readiness check

Ten questions, about two minutes. Yes scores 2, Partly 1, No or Not sure 0, for a score out of 20. Your answers stay in your browser; nothing is sent.

The check needs JavaScript.

Certificate Lifetime Readiness: a two-week project

A fixed-scope project that answers one question: what has to change so every certificate renews itself before the next cut? We work with your team; you make the decisions.

  1. Intake (your team, about 2 hours). A short questionnaire: where certificates live, who renews them, which certificate authorities and tools you use, what cannot be automated.
  2. Discovery session (2 hours). Walk through the inventory, the renewal path for a typical certificate, and how an expired certificate would be detected today.
  3. Analysis (King Tech). Gap map against the 100-day and 47-day dates, risk ranked by the business service each certificate protects.
  4. Readout (90 minutes). Findings, options and the decisions leadership needs to make, with a phased plan.

Deliverables

  • Certificate inventory approach and gap map
  • Owner and service mapping, ready to load into your CMDB
  • Monitoring design: expiry and failed-renewal alerts routed to owners
  • Automation path for each system type, including the ones that can’t automate yet
  • Renewal runbook and standard-change template
  • Leadership decision brief: ownership, policy, budget range and timeline

We don’t sell or install certificate management software as part of this project and we don’t recommend a product. If you decide to buy, we can help you compare options against your own criteria.

Fixed fee, agreed after a free 30-minute scoping call.

Book a scoping call →

Sources

    Facts checked Oct 13, 2026.

    Survey figures are as published by their sources; King Tech is independent and is not affiliated with any of them.

    The certificate deadline: the leadership view →