Why Enterprises Should Take Steps to Adapt to the Shortening of TLS Certificate Validity

Google’s Proposal to Shorten TLS Certificate Lifespan

Google, through The Chromium Projects that it controls, has proposed reducing the validity period for Transport Layer Security (TLS) digital certificates from 398 days to 90 days. The open-source move aims at promoting reliable and robust web operations, quicker adoption of best practices, and new security capabilities for automation in organizations, in preparation for post-quantum cryptography. However, the proposed changes call for a significant transformation of certificate processes, particularly regarding automated procedures, the current certificate monitoring system, and structure.

A Background to the Proposed Changes

Since 2012, the validity of digital certificates has steadily reduced, from five years to 398 days in July 2020, to reinforce digital identity accuracy, particularly in computing environments characterized by the dynamic creation or abolishing of websites and services for adjusting priorities and demands. As such, the proposed validity changes should encourage organizations to shift from manually cumbersome processes to automation, which fosters timely identification and resolution of expirations, leaving behind the threats of certificate-related outages.

Implications of the Proposed Changes for Organizations

Although the proposal to the CA/Browser Forum will probably take effect by the end of 2024, the proposed significant lifespan reduction should serve as a wake-up call for organizations to institute greater control and visibility of their public keys and certificates. The certificate monitoring system requires centralization to identify certificates nearing expiration, verify proper server deployment, and extend TLS visibility to supply chains. In-house monitoring may involve extensive infrastructure knowledge programming and maintenance, leading to confusion and dire consequences if executed wrongly, as the Ponemon Institute found in 2022 that half of the respondents had experienced at least one certificate-related threat in the previous two years, where the majority described it as severe financially.

Recommendations and Conclusion

Organizations must shift from the routine of manual management to automation as the proposed, shorter lifespan changes adjust to the interconnected nature of business operations, necessitating the extension of TLS visibility to supply chains. To avoid catastrophic outcomes, companies may want to consider outside monitoring subscriptions, while improving their internal infrastructure knowledge for easy identification of certificates that are about to expire.

Although still uncertain, the proposed changes represent the reality of today’s dynamic environment, where the shorter validity of digital certificates is beneficial for automating organizations’ processes and providing adequate security. However, the implementation will require organizations to overhaul their processes, current certificate monitoring system, and structure, inevitably calling for transformation.