The 90-Day Certificate Lifetime Shift: Embracing Automation

Introduction

SSL/TLS certificates play a pivotal part in ensuring websites (and more) transmit secure encrypted data and prevent unauthorized interception.

As you may have heard, on March 3, 2023, Google introduced the “Moving Forward, Together” initiative, where they share their vision for modern, reliable, highly agile, purpose-driven PKIs with a focus on automation, simplicity, and security.

In this blog post, you’ll delve into Google’s push for shorter certificate validity, the importance of SSL/TLS, the necessity for automation, risks, and more, providing valuable insights for DevOps services companies.

The push for 90-Day Certificate Validity

Google has recently revealed its intention to shorten the maximum duration for public Transport Layer Security (TLS) certificates from 13 months to just 90 days. The industry will experience a significant impact as a result of this change, and organizations are advised to start preparing now.

While Google’s reasons behind the push for 90-day certificate validity make sense, some organizations already have concerns about the change.

Reasons behind Google’s Push for shorter certificate validity periods

Some of the reasons are:

• Improved security: Frequently cycling certificates make it harder for attackers to use fraudulent certificates, improving overall system security.
• Faster adoption of new cryptographic standards: Shorter certificate validity periods encourage the adoption of emerging security capabilities and best practices, promoting the agility required to transition the ecosystem to quantum-resistant algorithms quickly.
• Reduced impact of certificate misissuance: Shorter-lived certificates decrease the impact of unexpected Certificate Transparency Log disqualifications, reducing the reliance on “broken” revocation checking solutions.

Resistance from the industry

And here are the expected challenges:

• Increased operational burden: Handling certificate renewals manually more than four times per year can be incredibly difficult, especially for organizations with a large number of certificates. Thus, automation to manage certificate lifecycles will be required.
• Compatibility issues with legacy systems: The move to 90-day certificates may cause compatibility issues, which need to be upgraded to accommodate shorter certificate lifetimes.
• Concerns about certificate revocation efficiency: 90-day certificates are still too long for a compromised certificate to exist, and moving to 90 days does nothing to improve revocation, which can still be slow, unreliable, and inefficient.

While the transition to 90-day certificates may pose challenges for some organizations, the benefits of improved security and faster adoption of new cryptographic standards make it a necessary change. The move also highlights the need for automation and certificate lifecycle management solutions to reduce the operational burden and ensure compliance with industry standards. The Role of Automation in Certificate Management Why automation is crucial for shorter certificate lifecycles.

The Role of Automation in Certificate Management: Why Automation is Crucial for shorter certificate lifecycles

As the digital world changes, automation in certificate management becomes crucial for shorter certificate lifecycles. Here’s why:

• Minimizing human error: With more frequent renewals, the chance of human mistakes, such as missed deadlines or incorrectly set up certificates, increases. Automation reduces these risks by automatically handling and monitoring the renewal process.
• Reducing administrative overhead: Managing the growing number of certificates manually becomes a burden on IT teams. Automation makes the process more efficient, saving time and resources that can be used for more critical tasks.
• Ensuring timely certificate renewals: Certificate expiration can lead to security risks and service disruptions. Automation ensures certificates are renewed on time, lowering the risk of downtime and potential harm to an organization’s reputation.

Automation tools and techniques

Several tools and techniques can help organizations adopt automation in certificate management:

• Automated Certificate Management Environment (ACME) protocol: ACME is a protocol that helps automate interactions between certificate authorities and their users. It helps automate the issuance, renewal, and revocation of SSL/TLS certificates. Popular CAs like Let’s Encrypt use the ACME protocol.
• Let’s Encrypt and other automated CA solutions: Let’s Encrypt is a free, automated, and open CA that provides SSL/TLS certificates for websites. It simplifies the process of getting and installing certificates, making it more accessible for smaller organizations and individuals. Other CAs, such as DigiCert, also offer automation features that streamline certificate management.
• Third-party automation tools: Various third-party tools can help automate certificate management across multiple CAs. These tools can discover, monitor, and manage certificates across your organization, ensuring compliance and reducing the risk of security breaches. Some tools for example are provided by DigiCert, Venafi, and Keyfactor.

CA-Agnostic Certificate Lifecycle Management (CLM) Solutions: The importance of CA-agnostic CLM solutions

With the potential shift to 90-day certificate validity, CA-agnostic CLM solutions become increasingly important for organizations due to their:

• Flexibility in choosing CAs: Organizations can work with multiple certificate authorities, selecting the best provider for their needs.
• Streamlined certificate management across multiple CAs: CA-agnostic CLM solutions simplify managing SSL/TLS certificates from different authorities through a unified platform.
• Easier migration between CAs: These solutions facilitate smoother transitions when switching certificate authorities by centralizing certificate management and minimizing disruptions.

Features of CA-agnostic CLM solutions

CA-agnostic CLM solutions offer features to simplify certificate management, such as:

• Centralized certificate inventory: A single dashboard to track and manage all SSL/TLS certificates, regardless of the issuing CA, helps maintain an organized inventory and reduces the risk of overlooking expiring certificates.
• Automation capabilities: These solutions incorporate automation features, such as auto-renewal and deployment of certificates, reducing human error and administrative overhead.

Popular CA-agnostic CLM solutions and their benefits

Several CA-agnostic CLM solutions address the challenges of managing certificates in a dynamic environment:

• DigiCert Trust Lifecycle Manager: A certificate management solution that offers a centralized platform for managing both public and private certificates across the organization, as well as PKI services.
• Sectigo Certificate Manager: This solution provides automated CA-agnostic CLM, enabling organizations to discover, deploy, install, and renew the lifecycles of all digital certificates, regardless of the issuing CA. It offers interoperability, helping businesses establish digital trust in remote and hybrid work environments.
• Keyfactor Command: Offering end-to-end certificate lifecycle automation and management, Keyfactor Command simplifies certificate issuance, renewal, and revocation processes. It supports multiple CAs and can scale to handle large enterprise environments.

As the industry moves towards potentially shorter certificate validity periods, organizations must embrace automation and consider CA-agnostic CLM solutions.

Conclusion

The trend towards shorter certificate validity periods is a reality, and organizations have the option to consider using automation and CA-agnostic CLM solutions to effectively manage their digital certificates. By embracing these technologies, they can streamline their certificate management, minimize risks, and maintain compliance in the ever-changing digital environment.

While Google can enforce policy changes related to certificate lifetime within its ecosystem, it remains open to feedback from the Web PKI community. However, it’s good to note that, due to Google’s significant influence in the market, its decisions are likely to have a considerable impact on industry practices.