SSL certificate management for the 47-day era

Certificate lifespans are collapsing. In April 2025, the CA/Browser Forum unanimously voted to reduce maximum TLS certificate validity from 398 days to just 47 days by March 2029. Apple proposed it. Google, Mozilla, and Microsoft voted in favor. Twenty-nine votes for, zero against.

The move didn’t come out of nowhere. Google had already signaled a push toward 90-day maximums in its “Moving Forward, Together” roadmap. Apple went further, proposing the phased reduction that ultimately passed as Ballot SC-081v3. The rationale: shorter lifespans reduce the window in which a compromised or outdated certificate can be exploited and they force the industry toward automation, since manual processes can’t keep pace with 47-day renewal cycles.

The first deadline hits March 15, 2026 — when maximum validity drops to 200 days. By 2027, it’s 100 days. By 2029, 47. Domain validation reuse shrinks to just 10 days.

Here’s the math most teams haven’t done yet. An organization managing 1,000 certificates — a conservative number for mid-size enterprises — currently handles roughly 1,000 renewals per year. At 47-day lifespans, that same set requires approximately 7,766 renewals annually. An 8x increase. Manual processes that barely work today will break completely.

As Virima’s Chief Strategy and Information Officer Salil Kulkarni puts it: the way most enterprises manage certificates won’t survive what’s coming. And the data backs him up. According to Keyfactor’s 2025 Digital Trust Digest, 86% of companies experienced at least one outage from expired or mismanaged certificates in the past year alone. Nearly a third report certificate outages every quarter. One in ten enterprises deals with them weekly.

This isn’t a future problem. It’s a current one that’s about to get 8x worse.

The real problem isn’t renewals — it’s visibility

Most certificate outages don’t happen because someone forgot a renewal date. They happen because the team didn’t know the certificate existed, didn’t know what depended on it, or didn’t know who owned it. A disciplined approach to SSL certificate management addresses these gaps by establishing end-to-end visibility across discovery, tracking, renewal, and revocation workflows.

Keyfactor’s 2024 PKI & Digital Trust Report found that the average organization experienced nine certificate-related incidents over the previous 12 months. Each incident took 2.6 hours to identify and another 2.7 hours to remediate. That’s roughly 5.3 hours of unplanned work per event, with eight staff members pulled in on average.

Only 32% of organizations use a dedicated certificate lifecycle management tool. The rest rely on spreadsheets, email reminders, and the institutional memory of whoever set up the certificate three years ago.

When certificate lifespans shrink to 47 days, institutional memory doesn’t scale. Spreadsheets don’t scale. What scales is knowing — with certainty and in real time — where every certificate lives in your infrastructure, what services depend on it, and when it needs attention.

That’s not a certificate management problem. It’s an infrastructure visibility problem.

Why infrastructure visibility is the foundation of certificate management

Think about what actually happens during a certificate outage. A cert expires on a server. The team gets paged. First question: which server? Second question: what services run on it? Third question: what other systems depend on those services? Fourth question: who last renewed this cert, and where else did they install it?

If your certificate tracking tool is disconnected from your infrastructure — a standalone dashboard that knows about certificates but nothing about the servers, applications, and services they protect — you’re answering questions 2 through 4 manually. During an active outage. Under pressure.

The organizations that handle the 47-day transition without a spike in outages will be the ones that already have infrastructure visibility in place. That means automated discovery that finds every asset, a CMDB that maps relationships between them, and service dependency views that show what breaks when something changes.

What to look for in an SSL certificate management approach

The 47-day timeline reshapes which capabilities actually matter. Features that were nice-to-have at 398-day lifespans become survival requirements at 47.

1. Automated discovery across your full environment

You can’t renew certificates you don’t know about. In a world where your team needs to touch every certificate 8 times a year instead of once, an unknown certificate isn’t just a risk — it’s a guaranteed outage.

Discovery needs to cover on-prem servers, cloud instances, load balancers, API gateways, containers, and internal applications. It needs to run repeatedly, not as a one-time project. Shadow certificates from departed employees, forgotten test environments, and inherited infrastructure from acquisitions are the ones that cause outages — because nobody’s tracking them.

2. Infrastructure context — not just a certificate list

A list of certificates with expiration dates is a spreadsheet. What you need is context: which server hosts this cert, which applications run on that server, which business services depend on those applications, and who owns the renewal.

This is the gap most standalone certificate management tools leave open. They track the certificate lifecycle but have no visibility into the infrastructure underneath it. When something expires, your team still has to manually trace the dependency chain to understand what’s affected.

The alternative is managing certificates within the same platform that tracks your infrastructure — where the relationships between servers, applications, and services are already mapped.

3. Lifecycle automation that scales to 8x volume

At 398-day lifespans, a manual renewal process with email reminders might work. At 47 days, it falls apart. The industry is already moving toward automated certificate lifecycle management through protocols like ACME (Automatic Certificate Management Environment), which Let’s Encrypt popularized and which now supports certificate issuance, renewal, and deployment without manual intervention. The CA/Browser Forum’s 47-day mandate effectively makes this kind of automation mandatory rather than optional.

At minimum, you need automated alerts at configurable intervals — 30 days, 14 days, 7 days, 1 day — delivered through channels your team actually monitors: ITSM tickets, Slack, email, or webhooks. Better yet: automated renewal workflows that generate tickets with full context (cert type, associated servers, CA, expiration date) so the renewal doesn’t start with “wait, what server is this on?”

4. Compliance evidence built into the workflow

Certificate changes — issuance, renewal, revocation — need logged audit trails with timestamps and user attribution. Frameworks like HIPAA, PCI-DSS, SOX, and ISO 27001 require encrypted data transmission for protected information, in alignment with standards like NIST’s TLS implementation guidelines. Auditors want evidence that your organization tracks certificate lifecycles, renews on schedule, and revokes compromised certificates promptly. A centralized tool with reporting and audit trails provides that evidence automatically.

5. Integration with operational workflows

Certificates don’t exist in a vacuum. A certificate renewal is a change. A certificate expiration is an incident. A mismanaged certificate is a compliance finding. Your certificate management approach needs to feed into the same ITSM workflows your team already uses ServiceNow tickets, Jira issues, change advisory boards, incident response runbooks.

Tools that manage certificates in isolation from your operational workflows create extra work, not less.

What happens when an SSL certificate expires?

An expired certificate triggers immediate, visible failures. Browsers display security warnings that block visitors. APIs return connection errors, breaking integrations downstream. For regulated industries, an expired certificate on a system handling protected data can constitute a compliance violation.

There’s also a security dimension that’s easy to overlook. An expired or unknown certificate is a gap in your attack surface — an unmonitored entry point that security teams can’t assess, patch, or revoke if compromised.

This is why cybersecurity asset management frameworks treat certificates as security-critical assets, not just operational ones. If your certificate inventory is incomplete, your security posture has blind spots.

The operational cost goes beyond the outage itself. Keyfactor’s 2024 report found that certificate incidents require an average of 8 staff members to remediate, all pulled from their primary responsibilities. At 5.3 hours per incident, that’s over 40 person-hours of unplanned work from a single expired certificate.

How should your team prepare for 47-day TLS certificates?

The March 2026 deadline (200-day maximum) is the starting gun. Teams that wait for the 47-day deadline in 2029 will be scrambling. Here’s the practical sequence:

Inventory what you have. Run a discovery scan that covers your full environment — on-prem, cloud, containers, and edge. You can’t plan for 8x the renewals if you don’t know your current certificate count.
Map where certificates live in your infrastructure. A certificate list isn’t enough. You need to know which servers host each cert, which services depend on those servers, and who owns the renewal. This is where a CMDB with relationship mapping pays off.
Automate the renewal workflow. Manual tracking breaks at scale. Set up automated alerts, ITSM ticket generation, and — where possible — automated renewal and deployment through ACME or your CA’s automation tools.
Test at 200-day lifespans first. The March 2026 deadline doubles your current renewal frequency. Use that as a proving ground for your automation. If your process can’t handle 2x, it certainly can’t handle 8x.

There’s a longer-term dimension here too. One driver behind the CA/Browser Forum’s decision is crypto agility — the ability to rotate cryptographic algorithms rapidly when post-quantum cryptography standards are fully adopted. Shorter certificate lifespans make that rotation practical rather than catastrophic. Organizations that build automation and visibility now won’t just survive the 47-day timeline — they’ll be positioned to handle whatever comes after it.

How Virima gives you the infrastructure visibility that certificate management requires

Certificate management tools tell you when a certificate expires. Infrastructure visibility tells you what breaks when it does. Virima provides the second — and that’s what makes the first actually useful.

Virima’s IT Operations Management platform combines IT discovery, an automated CMDB,ViVID service mapping, and Cybersecurity Asset Management to give your team complete visibility into the infrastructure your certificates protect. Rather than tracking certificates in a standalone tool disconnected from your servers, applications, and services, Virima maps the relationships between all of them.

As Virima COO Mike Bombard notes: asset lifecycle management is just one step in an overall IT asset management initiative — organizations looking to mature should also consider a CMDB.

Discovery that covers your full environment

Virima’s IT discovery uses agentless IP-based scanning and optional agents for Windows, macOS, and Linux to identify hardware, software, cloud resources, and network devices across your environment. With 100+ extendable probes and integrations with AWS andAzure, discovery captures detailed configuration attributes for each asset — including installed software, OS patches, running services, and configuration details.

This data feeds into Virima’s CMDB, giving your team a single source of truth for the infrastructure your certificates depend on. When you know exactly what’s running on each server and how services connect, you’re equipped to track which assets carry certificates and need renewal attention.

A CMDB that maps what depends on what

Virima’s CMDB tracks hundreds of hardware and software configuration attributes across data center, edge, cloud, and IoT assets, with full relationship and dependency mapping between them. Automated two-way syncing with ITSM platforms like ServiceNow and Jira Service Management keeps the data current without manual updates.

For certificate management, this means your team doesn’t just know that a certificate exists on a server — they know what applications run on that server, what services those applications support, and which ITSM records are tied to them. That infrastructure map turns a certificate renewal from a blind task into a risk-aware one.

ViVID service maps that show dependency impact

ViVID turns CMDB data into visual dependency maps showing the relationships between infrastructure components, applications, and services. When your team plans a certificate renewal or replacement on a critical server, ViVID shows which services depend on that infrastructure — along with overlays of open incidents, pending changes, and known NVD vulnerabilities.

This context helps your team assess the risk of the change, coordinate with the right stakeholders, and schedule the work with confidence.

Cybersecurity asset management for your certificate surface

Certificates are part of your attack surface. An unknown or expired certificate on a production server is a security blind spot — one that can’t be patched, rotated, or revoked if compromised. Virima’s Cybersecurity Asset Management approach treats every discoverable asset as a cyber asset, bringing security context to what’s traditionally been an operational task.

Virima’s NIST NVD integration identifies known vulnerabilities across your discovered assets, and ViVID displays those vulnerabilities on service maps alongside the infrastructure they affect. For teams managing certificates across regulated environments, this security-layer visibility bridges the gap between IT operations and cybersecurity — giving both teams a shared view of what’s exposed and what’s protected.

Asset lifecycle management with ITAM

Virima ITAM provides end-to-end lifecycle management for IT assets — hardware, software, licenses, and contracts — with data continuously updated through automated discovery. Your team works from a single source of truth rather than reconciling spreadsheets against production reality.

This accurate asset baseline makes certificate tracking practical: when you know every server, application, and cloud instance in your environment, you can identify which ones carry certificates and build reliable renewal processes around them.

Monitoring integration and ITSM workflows

Virima integrates with system monitoring and event management tools, enabling alerts about infrastructure events to surface automatically in ITSM workflows. Incidents can be created automatically from monitoring alerts and tied to the affected CMDB asset, giving your team immediate context when something needs attention.

Secure architecture

Virima’s Discovery Appliance runs on a server within your network — asset credentials used for scanning stay on-premise and are never transmitted to the cloud. Discovery data is encrypted in transit to Virima’s secure AWS-hosted platform, which uses multi-tenant architecture with full data segregation between tenants. Virima holds SOC 2 Type 2 certification.

Dependency awareness speeds up every type of incident resolution — including certificate-related ones. When an incident occurs, the first question is always “what’s affected?” Virima’s CMDB and ViVID service maps answer that by showing relationships between infrastructure components and the business services that depend on them.

For certificate-related incidents, your team can quickly identify which servers, applications, and services are affected — instead of manually tracing dependencies during an active outage. ViVID’s overlays show open incidents, recent changes, and known vulnerabilities on the same map, giving your team the context to resolve faster.

The first deadline is 11 months away

March 15, 2026. That’s when 200-day certificate lifespans take effect. The manual processes that barely work at 398 days have less than a year before they start failing at twice the current renewal frequency.

The organizations that handle this transition without a spike in outages will be the ones that already know where every certificate lives in their infrastructure, what depends on it, and who’s responsible for it. That’s infrastructure visibility — and it’s what Virima provides.

Request a demo to see how Virima’s discovery, CMDB, and ViVID service mapping give your team the infrastructure foundation that certificate management requires.

Top 10 features that make an SSL management solution stand out