Register for part 2 of our Device Identity Webinar Series!

Certificate lifetimes are collapsing. Manual renewal is what breaks first.

Public certificates now expire every 200 days, and every 100 from March 2027. Smallstep is a private CA: we don’t issue public certificates. We take the internal endpoints you’ve been putting public certificates on (RADIUS, VPN, internal web, devices) off that clock entirely, with hardware-bound certificates that renew themselves at whatever lifetime you choose.

Calculate your renewal cost
background gradientbackground texture
Short-lived by design
Enrollment over ACME device-attest-01
Hardware-bound, non-exportable keys
Unattended renewal at any frequency
Searchable issuance records
Fits your MDM and IdP

Renewal used to be a yearly chore. It is becoming a six-week one, and across a fleet it never stops.

Most teams still treat renewal as annual maintenance: track a spreadsheet, file a change ticket, generate a CSR, revalidate, install, confirm. That holds when a certificate lasts a year. The CA/Browser Forum ratified Ballot SC-081v3 in April 2025 with no votes against, and the reductions run from March 2026 to March 2029.

  • Until March 15, 2026: 398-day certificates
  • Now: 200 days, with domain validation reused for up to 200 days
  • From March 15, 2027: 100 days, with 100-day validation reuse
  • From March 15, 2029: 47 days, with 10-day validation reuse

The work scales with the frequency, unless there is no work.

Every renewal the schedule adds is either a ticket someone runs by hand or an event nothing has to touch. Automated issuance handles a 47-day cycle at the same operational cost as an annual one, which is why the wall arrives for manual processes and not for automated ones.

It is already arriving: one university’s RADIUS certificates on Cisco ISE went from annual renewal to every four months, which is what put a private CA on their shortlist.

Hardware-attested issuance, renewed without a person in the loop.

The private key is generated inside the device’s TPM or Secure Enclave and never leaves it. Enrollment uses ACME device-attest-01, the IETF standard whose design credits Smallstep’s implementation experience, so the issuer validates hardware evidence rather than a shared SCEP challenge phrase anyone can copy.

A certificate that renews itself cannot lapse because someone missed a date.

Most certificate outages trace to a missed date. Unattended renewal removes the window entirely, and because every issuance ties to a user and an enrolled device, audits and incident reviews have one place to look instead of a spreadsheet.

What the 47-day era costs you in labor

Estimate the engineer time manual renewal consumes as certificate lifetimes shrink. Move the inputs to match your environment.

Certificates under management 5,000 certificates
25050,000
Engineer minutes per manual renewal 20 min
560
Fully-loaded cost per engineer hour $85 per hour
$40$200
Mandate phase

7.8 renewals per certificate a year — 4.3x the volume of today’s 200-day cycle.

Manual renewal labor per year

$1.1M

At 47-day lifetimes, with these settings

Renewals handled per year38,830
Engineer-hours per year12,943
At today’s 200-day cycle$258,542
From March 15, 2027 (100 days)$517,083

$15,000 a minute

And that is only labor. A missed renewal is an outage, and Splunk puts the average cost of downtime at $15,000 per minute. Unplanned downtime now costs Global 2000 companies $600 billion a year. Source: Splunk, The Hidden Costs of Downtime, 2026.

Bring your certificate count and where those certificates live. We will show which endpoints can move to private, automated issuance.

Talk to sales

Illustrative estimate. Manual labor is modeled as certificates × renewals per year (365 ÷ certificate lifetime in days) × handling minutes × hourly cost. Your actual figures depend on discovery, validation, and install effort per certificate.

See what automated issuance saves you.

Bring your certificate count and where those certificates live. We will show which endpoints can move to private, automated issuance and where the labor and the outage risk go.

Book a demo

Questions about shrinking certificate lifetimes

Yes. The CA/Browser Forum passed Ballot SC-081v3 in April 2025 with no votes against, 25 to nil among certificate issuers and 4 to nil among certificate consumers. Maximum public TLS certificate lifetime steps down from 398 days across a schedule that began in March 2026 and concludes at 47 days in March 2029.

No. Smallstep is a private CA. For public-facing sites, an ACME client with a public CA automates renewal; the Smallstep docs show Let’s Encrypt with cert-manager on Kubernetes. Where public certificates sit on internal endpoints such as RADIUS, VPN gateways, and internal web services, those can move to private certificates that Smallstep issues and renews, for clients that trust your private root.

The ballot covers publicly trusted TLS certificates. Internal PKI is not bound by it, but the same operational pressure applies wherever you have chosen short lifetimes for security reasons, and most teams standardize on one process rather than running two. Automated issuance removes the frequency question either way.

Domain validation data reuse tightens on the same schedule. The ballot reduces non-SAN validation data reuse from 825 days to 398, and SAN validation data reuse from 398 days to 10. Revalidation becomes part of the renewal cadence rather than an occasional event.

SCEP enrollment rests on a challenge phrase, with no cryptographic proof that a request came from company-owned hardware. AD CS renews automatically only for domain-joined Windows; macOS, Linux, and ChromeOS fall back to SCEP challenge phrases or manual CSRs. Smallstep uses ACME device attestation, which binds issuance to the device’s secure hardware, and renews unattended.

Not necessarily. Smallstep works as a drop-in replacement for AD CS with backwards-compatible SCEP and NDES support, and, on an Advanced Authority, it can adopt your existing root CA rather than forcing a new trust anchor. Teams often run the migration and the renewal automation as one piece of work; the AD CS cost calculator models both.

Windows 10 or later with TPM 2.0, macOS 13 or later on Apple silicon, and enterprise Linux distributions with TPM 2.0. Windows Home editions are not supported. ChromeOS is handled through the Smallstep extension using Google Verified Access rather than through the agent. Requirements are in the agent documentation.

Only the engineer time to handle renewals as frequency rises. It does not count outage cost, audit effort, or the risk of a lapse, all of which move in the same direction. Treat it as a floor rather than a forecast.

Most public CAs price by subscription rather than per issuance, so the cost of the schedule lands on operations rather than on a line item. That is the cost automation removes.