Getting Ahead of Shrinking Certificate Lifespans and the Quantum Clock

Key Takeaways

• Certificate lifespans will shrink from 398 to 47 days by March 2029 with “domain validation reuse” shrinking to just 10 days, making manual renewal obsolete and automatic Certificate Lifecycle Management (CLM) necessary.
• Harvest Now, Decrypt Later operations are already underway to store data with long lifespans for future decryption using quantum computers, which means there is an immediate threat to encrypted, sensitive data that have longer term retention.
• Certificate/Crypto Inventory is most crucial for companies to start building now, as continuous and automated inventory is the first step toward long-term cyber-resilience and crypto-agility.

The Problem Hiding in the Background

Most modern enterprise networks rely on a hidden layer comprised of digital certificates and cryptography that most people never see. This layer verifies machine trust and secures data flows, but with machine identities now outnumbering human identities by more than 80 to 1 in the average enterprise according to CyberArk’s machine identity research, it can be easy to underestimate the cryptographic and certificate layer’s importance.

A helpful way to think about a digital certificate is an ID badge for a machine. If the badge is valid, the doors open automatically and no one thinks about it, but the moment that badge expires or is misconfigured, the door stops opening, regardless of how legitimate the machine behind it is. A single expired certificate can take down websites, break the APIs that let applications talk to each other, interrupt transactions, and create compliance violations, all while eroding user trust.

For years, organizations have managed certificates manually, but two changes are going to make it impossible to keep up by hand. First, the maximum lifespan of public Transport Layer Security (TLS) certificates, the protocol securing your browser, is being compressed to just 47 days by 2029. Second, the eventual arrival of quantum computers powerful enough to break today’s encryption is forcing a transition to Post-Quantum Cryptography. These two issues both point to the same solution – a governed, automated, and crypto-agile approach to CLM.

The Roadmap Behind Shrinking Certificate Lifespans

The operational window for public TLS certificates has been narrowing for a decade. In early 2023, Google first published its “Moving Forward, Together” roadmap, which proposed reducing certificate validity from 398 days to 90 days in hopes to push the industry toward automation. Apple accelerated that timeline in October 2024 by introducing a draft ballot to the CA/Browser Forum, the industry body where certificate authorities and browser makers set shared rules. Apple’s proposal, endorsed by Sectigo, Google Chrome, and Mozilla, was approved in April 2025 as Ballot SC-081v3.

This reduction happens in phases. The past 398-day maximum has already dropped to 200 days as of March 2026, with the maximum being reduced to 100 days in March 2027, and finally to 47 days in March 2029. In practical terms, an organization that currently renews each certificate about once a year will soon be renewing every certificate roughly every month and a half; by the final stage, any process that depends on a person manually requesting and installing certificates will fail.

Browser makers are pushing for these shorter lifespans to force automation, which removes the human error that causes most certificate outages in the first place. They also let the entire web adopt new cryptographic standards in weeks rather than years, since old certificates cycle out quickly. Additionally, they help reduce reliance on legacy revocation systems which suffer from performance and privacy problems. Lastly, if a Certificate Transparency log (a public record of issued certificates) is ever disqualified, short-lived certificates dramatically shrink the number that must be replaced on short notice.

The Validation Crunch

While the 47-day limit gets headlines and attention, the more disruptive change may be what happens to Domain Control Validation (DCV). DCV is the process of proving to a Certificate Authority (CA) that you control the domain you are requesting a certificate for. Historically, once an organization proved ownership, the CA could reuse that proof for up to 398 days, but under SC-081v3, the reuse window shrinks to 200 days in 2026 and to just 10 days by March 2029.

This creates a real imbalance, as even an organization that fully automates certificate installation will stall if it cannot re-prove domain ownership every 10 days. Any delay in validation halts the entire issuance pipeline and leads directly to outages.

The practical answer to this problem is adopting the Automatic Certificate Management Environment (ACME) protocol with automated DNS-01 API validation, so that proving ownership happens programmatically rather than waiting on a person.

The Quantum Threat and Timeline

While certificate lifespans shrink, the algorithms inside those certificates face a quantum threat. Traditional Public Key Infrastructure (PKI) rely on asymmetric cryptography to secure digital signatures, key exchanges, and TLS connections. A sufficiently powerful quantum computer running Shor’s algorithm could break these systems completely. Waiting until quantum computing is powerful enough to decrypt is not a viable option; as Commvault Field CTO Vidya Shankaran has written, “the exact date of Q-Day may remain uncertain. The direction of travel is not.” 

Estimates place Q-Day, the point at which a quantum computer can break public-key encryption, somewhere in the next 5 to 10 years. However, it would be a mistake to treat this as a future problem. Threat actors are already conducting Harvest Now, Decrypt Later (HNDL) operations, intercepting and storing encrypted traffic today with the intention of decrypting it once quantum computing matures. Data that must stay confidential for years, such as health records, intellectual property, and financial information, is effectively exposed the moment it is harvested.

The U.S. Federal Government has responded accordingly: In June 2026, the White House issued Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, which sets deadlines well ahead of NIST’s original 2035 target: Federal high-value systems must adopt post-quantum key establishment by the end of 2030 and post-quantum digital signatures by the end of 2031.

Despite this urgency, actual progress toward enterprise-level crypto-agility has been slow. The DigiCert Quantum Readiness Outlook found that more than half of surveyed organizations expect classical asymmetric encryption to be broken within five years, yet only 7% have deployed quantum-safe or hybrid cryptography across their certificate estates, and overall readiness improved by just 2 percentage points in the past year.

Why Does Crypto-Agility Matter?

The most practical bridge between classical and post-quantum cryptography is the hybrid composite certificate, which combines a classical algorithm (RSA or ECC) with a post-quantum algorithm (ML-DSA, the standardized lattice-based signature scheme) inside a single X.509 certificate. Combining both into a single certificate is designed so that the certificate will hold up as long as either algorithm does, which is essential, as post-quantum algorithms are new and haven’t yet survived countless attempted attacks like RSA has.

However, post-quantum keys and signatures are several kilobytes rather than a few hundred bytes, which increases network latency, risks packet fragmentation during the TLS handshake, and adds computational overhead that may require hardware upgrades for constrained devices. This is exactly why crypto-agility matters; organizations need the ability to test, deploy, and rotate algorithms without rewiring their underlying infrastructure each time standards evolve.

Automated Certificate Lifecycle Management

Manual certificate management is not just inefficient; it is a genuine operational liability. When certificates live in spreadsheets out of sight, organizations lose visibility, and the result is expired credentials, weak key sizes, outdated signature algorithms, and noncompliant configurations that no one notices until something breaks. The resulting outages can confuse users, interrupt revenue, and land on whichever team is least prepared to explain them.

A complete CLM platform addresses this across the full life of a certificate:

• Discovery: continuous scanning of cloud environments, datacenters, containers, and external domains to find all certificates in use.
• Monitoring: tracking expiration dates, algorithms, key strengths, and compliance with security policy in real time.
• Validation: Utilize direct API integration with public and private CAs, while automating domain validation and approvals
• Installation: Deploy renewed certificates and keys programmatically through ACME or secure APIs, with no manual handoffs.
• Revocation: Executing fast, policy-driven revocation is necessary so a compromised certificate can be rotated or revoked everywhere at once rather than hunted down machine by machine.

There is also a payoff hiding in the discovery step: The certificate inventory a CLM platform maintains is, in effect, the beginning of the cryptographic inventory that post-quantum migration planning requires, which can turn a compliance chore into a head start.

Non-Human Identities and Agentic AI

The scale problem is compounded by how modern applications are built. Containers, Kubernetes pods, virtual machines, Internet of Things (IoT) devices, and APIs all need their own credentials, and many of these workloads exist for only minutes or hours before terminating. No team of humans can issue and retire certificates at that velocity.

To keep up with this breakneck pace, AI agents can be utilized to discover, issue, renew, and manage certificates on their own, while remaining inside existing guardrails such as security policies, role-based access control (RBAC), and centralized audit trails. The result is automation at machine speed without giving up enterprise governance.

Where To Start

1. The first step toward company-wide crypto-agility and resilience is organizational rather than technical. Following guidance from NIST, enterprises should establish a central machine identity services team that owns the CLM platform, standardizes certificate templates, and maintains integrations with public and private CAs. Individual application owners and DevOps teams, in turn, should be responsible for wiring automated renewals into their own deployment pipelines, using the central platform as a shared service. This split keeps governance consistent while eliminating the manual handoffs that cause outages.
2. Organizations should replace manual validation techniques and workflows with ACME and automated DNS-01 validation now, well before the 10-day DCV window arrives, while deprecating every manual renewal and validation process along the way.
3. 1. 1. In parallel, organizations should conduct a full inventory of their cryptographic assets to surface hardcoded keys, legacy algorithms, and long-lived trust paths protecting sensitive data.
      2. Post-quantum preparation should start in a controlled environment rather than in production. A dedicated testing lab should be established to allow teams to test hybrid composite certificates and crypto-agile upgrades in a sandbox. By building applications on modular cryptographic libraries connected to a dynamic CLM platform, enterprises can gain true crypto-agility: the ability to rotate keys, ciphers, and algorithms across their infrastructure as standards change, without a rebuild.

The thread that connects all recommendations is inventory. A CLM platform’s discovery step is not busywork before the real fix; it is the same discipline organizations will need across every layer of quantum readiness. Certificates are non-human identities, and the same questions apply to service accounts, AI agents, open source dependencies, and the algorithms buried in application code: What do we have, what does it protect, and which of it matters most to the business?

Organizations that build that inventory muscle now, starting with certificates, will find the rest of the transition far less daunting, because prioritization becomes a calculation rather than a guess. Treating the next few years as a planning window rather than a grace period will help organizations make this transition on their own terms, instead of letting an outage make the decision for them.

Caitlin Dodson is a Summer 2026 Intern for FCTO – Americas at Commvault.