TLS certificate lifetimes are dropping to 200 days (2026), 100 (2027), and 47 (2029). What actually changes at small and large scale when renewals go from yearly to eight times a year - and what a team that's ready looks like.
Once you pass a few hundred TLS certificates, managing them becomes its own discipline. A practical framework for inventory, ownership, renewals, and the silent failures that have nothing to do with expiry.
In the two weeks ending August 27, 2026, more than 30 public CAs logged 69 compliance incidents in Mozilla's tracker - delayed revocations, country-field and clientAuth misissuance, and the process failures that precede distrust. Every incident sourced to its Bugzilla bug, grouped by what it means for the certificates your business depends on.
Post-quantum migration, 47-day validity, DCV method churn, ecosystem distrust events. That's the PKI work your team should be doing. Renewal monitoring isn't.
Two reasons Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID: distrusted legacy roots (SSL.com 2016, DigiCert G1, Entrust) - the live, current cause - and CA-side compliance revocations, illustrated by a mid-sized CA's forced revocation of 63,525 certificates in July 2026. CA-agnostic diagnostics and fix steps.
Subscribe via RSS.