Certificate Lifecycle Management (CLM)
Certificate lifecycle management (CLM), often called certificate management, is the practice of discovering, issuing, renewing, and revoking X.509 certificates, such as TLS certificates, across an organization. Automation matters because expired or unmanaged certificates cause outages and create machine-identity risk.
Certificate expiry is one of the few identity failures that causes a visible outage rather than a quiet compromise, which is why it gets budget. Under CA/Browser Forum Ballot SC-081v3, approved in April 2025, the maximum validity of a publicly trusted TLS certificate is 200 days for certificates issued from March 15, 2026, then 100 days from March 15, 2027 and 47 days from March 15, 2029. At those lifetimes manual renewal stops being viable and automation becomes mandatory. The identity angle is that a certificate is a machine credential: the same questions about ownership, rotation, and revocation apply as for any other non-human identity.
See also: certificate lifecycle management guide, PKI, X.509, mTLS, what is machine identity, ACME, certificate authority
Related on Start with Identity
- GlossaryProof of Possession (PoP)
Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the to
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- GlossaryUser Lifecycle Management
User lifecycle management is the automated creation, change and removal of a person's accounts and access as their relationship with an organization changes, dr
- ArticleCertificate Lifecycle Management: What Breaks and How to Automate It
Certificate management explained: discovery, issuance, renewal, and revocation across public and private PKI, why the CA/Browser Forum schedule to 47-day certif
- BlogBrowsers block eight eMudhra intermediate CAs after their private keys are exposed
A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later
- GlossaryConsent Management
Consent management is the capture, storage and enforcement of a user's consent to specific data processing and communications, with a record of what they were s