PKI and certificate lifecycle

Most outages start with a certificate nobody owned.

A two week audit that finds every certificate in your environment, tells you which ones are about to break something, and hands you a plan to automate the rest.

Book a certificate audit Fixed fee. Nothing to install.

Sample findings 147 certificates · 19 with no owner

Common name	Issuer	Owner	Expires
portal.example.org	Public CA	unassigned	11 days
vpn.example.org	Internal CA (2011)	unassigned	26 days
*.internal.example.org	Internal CA (2011)	Network	73 days
api.example.org	ACME	Platform	automated

Illustrative. Your report looks like this, with your names in it.

Public certificate lifetimes are collapsing.

The CA/Browser Forum voted in April 2025 to cut the maximum lifetime of a public TLS certificate from 398 days to 47. The first phase is already live. Any renewal process that involves a person remembering to do something will not survive the next two steps.

Since March 2026

200 days

In effect now. Most CAs are issuing at 199 days.

March 2027

100 days

Manual renewal starts failing at any real scale.

March 2029

47 days

Eight renewals a year per certificate. Domain validation reuse drops to 10 days.

Three passes, because one never finds everything.

Scanning alone misses the certificates issued by a CA nobody documented. Interviews alone miss the ones nobody remembers. Doing all three is the only way the inventory comes out honest.

PASS 01

Outside in

Certificate transparency logs and external scanning across your domains and subdomains. This is where the systems nobody told IT about turn up.

PASS 02

Inside the network

TLS scanning across your internal ranges, pulling issuer, key strength and expiry from load balancers, appliances and servers.

PASS 03

Ask the teams

Short conversations with the people issuing certificates. There is almost always an old Windows CA still signing things.

Start with the audit. Keep the monitoring if it earns its place.

Certificate audit

One time, two weeks start to finish

$2,400fixed

Discovery across your external and internal estate
Risk register with owners named
Remediation roadmap and automation plan
Inventory spreadsheet you keep

Ongoing certificate operations

Monthly, cancel any time

$850per month

Expiry monitoring and renewal tracking
ACME automation built out and maintained
Quarterly rescan for new certificates
Someone to call when something expires anyway

Before you get in touch.

Do you need access to our network?

For the internal pass, yes, read only access from a host inside your network is enough. The external pass needs nothing from you beyond a list of your domains. Some clients start with the external pass alone to see the quality of the work first.

Are you going to tell us to buy a platform?

No. The report recommends the cheapest thing that solves the problem, which for most organizations is ACME automation on the certificates that support it and disciplined tracking on the ones that do not. If you already own a certificate management platform, the report tells you what it is missing.

Our certificates are all from one CA. Is an audit still worth it?

That is what most people believe before the scan runs. The certificates that cause outages are the ones outside the process, on appliances, internal CAs, test environments that quietly became production, and vendor-managed systems.

Do you work with internal or private PKI?

Yes. The 47 day rule only applies to publicly trusted certificates, but internal certificate authorities are usually where the oldest and least documented certificates live. They are included in the audit.

Are you local?

Based in southern Utah and available on site for organizations in the region. Everything else is done remotely, which most of the work is anyway.