Enterprises face significant challenges and financial risks due to inadequate digital certificate management, with a substantial number experiencing costly service outages from expired or mismanaged certificates. A recent report indicates that nearly one in four organizations reported their most severe certificate incident cost over $250,000.
The report, based on a survey of IT and security leaders, highlights that 34% of companies have experienced a service outage due to an expired certificate, while 40% reported downtime linked to general certificate mismanagement. Nearly three-quarters of respondents endured at least five hours of downtime from certificate issues over the past year, with 21% experiencing 25 hours or more. These incidents are largely categorized as IT infrastructure issues by 57% of organizations, though 17% classify them as security incidents.
The volume of digital certificates is growing, with over half of organizations managing more than 1,000 certificates. This increasing volume, coupled with manual processes for issuance, renewal, deployment, and remediation, is significantly burdening IT teams. Almost half of organizations engage in certificate management tasks at least 12 times a year, and another 39% do so six to ten times annually. Key concerns include certificate expiration, maintaining customer trust, ensuring regulatory compliance, and managing certificates across multiple cloud environments and platforms.
A major impending change is the move towards 47-day public TLS certificates by 2029, a directive from the CA/Browser Forum aimed at enhancing Web PKI security by keeping certificate and validation information more current and reducing the window for compromised credentials. This shift will drastically increase the certificate management workload, requiring organizations to renew certificates more than eight times as often and conduct 40 times more domain validations compared to previous lifecycles.
Nearly three-quarters of IT and security leaders anticipate an increase in certificate volumes over the next two years, and 70% are actively preparing for shorter certificate lifespans. However, some organizations are aware of the changes but have not yet begun preparations. The need for automation is critical, as manual methods like spreadsheets and calendar reminders will not scale with the increased frequency of renewals.
Automated certificate lifecycle management is now a high cybersecurity priority, ranking third after AI-powered security operations and software threat detection and response. Beyond renewals, organizations are prioritizing DevOps integration for certificate management improvements, along with enhanced visibility, compliance, software supply chain security, and a reduction in manual work.
Despite the clear benefits, several barriers hinder the adoption of comprehensive certificate automation. Cost is a significant factor, with budget constraints limiting further investment, even though over half of organizations allocate more than 10% of their security budgets to certificate management. Other challenges include incompatibility with legacy systems, a lack of executive support, uncertainty regarding the business case or return on investment, and a shortage of technical expertise. Only 10% of surveyed organizations currently have full automation in place.
