IT Leaders Overconfident in TLS Certificate Management Amidst Shorter Lifespans
A new survey reveals a significant disconnect between IT leaders' perceived readiness for shorter TLS certificate lifespans and their actual automation levels, leading to widespread incidents.
A recent survey conducted by certificate authority Sectigo highlights a concerning gap in IT leadership's understanding and implementation of automated TLS certificate management. While 40% of the 500 senior IT and security professionals surveyed expressed high confidence in their preparedness for monthly certificate renewals due to existing automation, the reality painted by their responses is starkly different. Only a mere 4% of organizations reported having fully automated certificate management systems in place, directly contradicting the confidence levels expressed by a significant portion of respondents.
This disconnect is further underscored by the fact that 61% of organizations experienced a certificate-related outage or incident within the past year. These incidents, occurring even under the previous, longer certificate lifespan rules, point to widespread vulnerabilities and operational challenges stemming from manual or semi-automated certificate management processes. The findings suggest a significant portion of IT leaders are either misinformed about their automation status or are overestimating their capabilities.
The CA/Browser Forum, the industry body governing publicly trusted certificates, has been progressively shortening the maximum lifespan of TLS certificates. Initially 398 days, the limit dropped to 200 days in March 2026, with further reductions to 100 days by March 2027 and 47 days by March 2029. This accelerated renewal cycle means organizations still relying on manual processes will face a significantly increased workload, with each renewal presenting a new opportunity for human error and subsequent service disruption.
The survey data reveals that approximately 61% of respondents automate half or fewer of their certificate renewals, with only 4% automating more than 90%. This leaves a substantial gap between the perceived preparedness and the actual state of automation. Even when considering all automation bands, at most 35% of respondents automate more than half their renewals, falling short of the 40% who claimed to be "very prepared" due to automation. This discrepancy suggests that some respondents who feel prepared may not fully grasp their organization's automation capabilities or may be unaware of the true figures.
Confidence levels are also high, perhaps excessively so, regarding certificate inventory and tracking. Thirty-three percent of IT leaders are extremely confident they track all certificates, including rogue ones, with an additional 48% expressing high confidence. However, the existence of rogue certificates—those issued without IT's knowledge—makes such certainty difficult to verify internally. Despite these confidence levels, 62% reported maintaining a complete, up-to-date inventory of public TLS certificates, a notable increase from 28% in 2025.
This confidence extends to the realm of post-quantum cryptography (PQC). A significant 74% of respondents are either extremely or very confident that their current systems can integrate PQC without major disruption. This optimism, however, exists within the same sample where 61% reported a certificate incident in the past year, raising questions about the readiness for future cryptographic challenges.
"PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice," stated Nick France, CTO at Sectigo. The upcoming reduction in certificate lifespans to 100 days by March 2027 will place renewals on a roughly quarterly cycle, intensifying the need for robust automation and proactive management to avoid the types of incidents already plaguing a majority of organizations.