Certificate Lifecycle Management (CLM)
Certificate lifecycle management (CLM), often called certificate management, is the practice of discovering, issuing, renewing, and revoking X.509 certificates, such as TLS certificates, across an organization. Automation matters because expired or unmanaged certificates cause outages and create machine-identity risk.
Certificate expiry is one of the few identity failures that causes a visible outage rather than a quiet compromise, which is why it gets budget. Under CA/Browser Forum Ballot SC-081v3, approved in April 2025, the maximum validity of a publicly trusted TLS certificate is 200 days for certificates issued from March 15, 2026, then 100 days from March 15, 2027 and 47 days from March 15, 2029. At those lifetimes manual renewal stops being viable and automation becomes mandatory. The identity angle is that a certificate is a machine credential: the same questions about ownership, rotation, and revocation apply as for any other non-human identity.
See also: certificate lifecycle management guide, PKI, X.509, mTLS, what is machine identity
Related on Start with Identity
- GlossaryProof of Possession (PoP)
Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the to
- ArticleCertificate Lifecycle Management: What Breaks and How to Automate It
Certificate management explained: discovery, issuance, renewal, and revocation across public and private PKI, why the CA/Browser Forum schedule to 47-day certif
- BlogBrowsers block eight eMudhra intermediate CAs after their private keys leak
A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were compromised. Ch
- GlossaryConsent Management
Capturing, storing, and honoring user consent for data processing and communications, often to satisfy GDPR and similar laws. Central to customer identity and p
- GlossaryDPoP
Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important
- PodcastSectigo
Short, frequent episodes on PKI, certificate policy, and post-quantum migration from two certificate industry veterans at Sectigo. 670 episodes and counting.