Certificate failures can cost firms over $250,000
The move toward 47-day public TLS certificates by 2029 will increase the certificate management workload for enterprises, according to DigiCert’s Certificate Management Outlook. Organizations will need to renew certificates more than eight times as often as under the previous certificate lifecycle and conduct 40 times as many domain validations.
What certificate management challenges were listed as a combination of very or extremely concerned? (Source: DigiCert)
Certificate failures cause costly outages
Certificate failures can disrupt business operations. Some 34% of companies experienced a service outage caused by an expired certificate, while 40% reported downtime linked to certificate mismanagement.
Nearly three-quarters experienced at least five hours of downtime from certificate issues over the past year, including 21% that experienced 25 hours or more. Certificate expiration remains a common cause of outages and creates risks for organizations that rely on manual tracking and renewal processes.
Nearly one in four respondents said their most significant certificate incident cost more than $250,000.
Some 57% categorize certificate outages as IT infrastructure issues, while 17% classify them as security incidents. Certificate management is therefore an infrastructure responsibility that can affect service availability and business operations.
Certificate volumes increase IT workloads
Growing certificate volumes are creating more work for IT teams. More than half of organizations manage over 1,000 digital certificates. Some 49% work on certificate management and related security tasks at least 12 times a year, while another 39% do so between six and 10 times. Manual issuance, renewal, deployment and remediation can consume more IT resources as certificate volumes grow.
Expiration, customer trust, regulatory compliance and certificate management across multiple clouds and platforms are key concerns for organizations.
Managing internal and external systems simultaneously is a concern for 52% of respondents. Certificates are often spread across different platforms and environments, increasing the need for centralized management and automation to reduce manual work.
Preparing for 47-day certificates
Nearly three-quarters of IT and security leaders expect certificate volumes to increase over the next two years. Some 70% are preparing for shorter certificate lifespans, while other respondents are aware of the changes but have not started preparing.
“An expired certificate can shut down a critical service just as quickly as any other infrastructure failure,” said Mike Nelson, Global Vice President, Field CTO at DigiCert. “With certificate lifecycles shrinking to 47 days, spreadsheets and calendar reminders simply won’t scale. Organisations need to know every certificate they have, where it is, who owns it, and then automate the lifecycle before an overlooked expiration becomes a business outage.”
Some companies expect certificate volumes to grow substantially, requiring them to discover, validate, issue and deploy certificates faster across their environments. They can prepare by automating more of the certificate lifecycle.
Preparation varies by market, with U.S. organizations further along than those in the U.K. and Australia. Shorter certificate lifecycles will add to workloads for teams that continue to rely on manual processes.
The CA/Browser Forum is shortening certificate lifespans to improve Web PKI security. Shorter lifespans are intended to keep certificate and validation information more current and reduce the period in which compromised or outdated credentials remain valid. Companies will consequently need to manage renewals more frequently.
Certificate automation expands beyond renewals
Automated certificate lifecycle management ranks as the third-highest cybersecurity priority, behind AI-powered security operations and software threat detection and response.
Over the next 12 months, DevOps integration ranks first for certificate management improvement priorities. Visibility, compliance, software supply chain security and reducing manual work also rank ahead of automated certificate renewal. Certificate automation therefore needs to cover the lifecycle and connect with the systems, teams and workflows that use certificates.
Australia prioritizes expanding compliance programs, while organizations in the U.S. and U.K. place certificate visibility at the top of their priorities.
Legacy systems slow certificate automation
Companies are allocating part of their security budgets to certificate management, and cost remains a barrier to further automation. More than half allocate over 10% of their security budgets to certificate management and related solutions, although budget constraints remain a barrier to further automation.
Other barriers include legacy system incompatibility, a lack of executive buy-in and uncertainty about the business case or return on investment. A lack of technical expertise also limits adoption.
Only 10% said they already have automation in place when asked about implementation barriers. Expanding automation will require integration with existing systems and a business case for reducing outages and manual work.
