# certificate-lifecycle

Source: https://startwithidentity.com/glossary/certificate-lifecycle/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

Certificate lifecycle management (CLM), often called certificate management, is the practice of discovering, issuing, renewing, and revoking X.509 certificates, such as TLS certificates, across an organization. Automation matters because expired or unmanaged certificates cause outages and create machine-identity risk.

Certificate expiry is one of the few identity failures that causes a visible outage rather than a quiet compromise, which is why it gets budget. Under CA/Browser Forum [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/), approved in April 2025, the maximum validity of a publicly trusted TLS certificate is 200 days for certificates issued from March 15, 2026, then 100 days from March 15, 2027 and 47 days from March 15, 2029. At those lifetimes manual renewal stops being viable and automation becomes mandatory. The identity angle is that a certificate is a machine credential: the same questions about ownership, rotation, and revocation apply as for any other non-human identity.

See also: [certificate lifecycle management guide](https://startwithidentity.com/guides/machine-identity/certificate-lifecycle-management-guide/), [PKI](https://startwithidentity.com/glossary/pki/), [X.509](https://startwithidentity.com/glossary/x509/), [mTLS](https://startwithidentity.com/glossary/mtls/), [what is machine identity](https://startwithidentity.com/guides/fundamentals/what-is-machine-identity/)