Certificate lifecycle management is software that finds every digital certificate a company uses, renews each one before it expires and installs the new one in the right place. A digital certificate is a small file that proves that a website or a machine is who it claims to be. It is issued by a certificate authority, and it is valid only until a fixed date.
Certificates are everywhere in a company. Every website uses one for HTTPS, which most browsers show as a padlock or a similar icon next to the web address. Servers use certificates to prove who they are to each other, and programs use them to log in to databases. So a certificate is one kind of non-human identity. The whole system of certificates and the keys that go with them is called public key infrastructure (PKI). A large company may have tens of thousands of certificates, issued by different teams over many years.
When a certificate expires, browsers and programs stop trusting it. A website shows a warning page, and a program refuses to connect. Many large outages have started in this way. Nobody attacked anything, but one forgotten certificate expired.
Consider a broadband provider in Ahmedabad. Its team believes that it has about 900 certificates. The software scans the provider's networks, its cloud accounts and its load balancers, and finds 3,400. About 300 of them have no known owner. One of these, on the page where customers pay their monthly bill, expires in nine days. The software asks the certificate authority for a new certificate. It uses a standard method called ACME, through which a server proves that it controls the domain and receives a certificate automatically. The software installs the new certificate on the load balancer that serves the payment page, and removes the old one. No customer notices.
Soon, automation will be the only practical way to manage certificates. Public website certificates used to be valid for about a year. Browser makers and certificate authorities have agreed to shorten this in steps: to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. With 3,400 certificates, renewing each one by hand every few weeks is not possible.
The software also manages the private key that goes with each certificate. The keys are stored in encryption key management systems. Certificates for programs are handed out through secrets management. A larger change lies ahead. Post-quantum cryptography is a set of new algorithms designed to resist attacks by future quantum computers. Every certificate will have to be replaced with one that uses them, and a company that already knows where all its certificates are can make that change much faster.