Gartner® Report: Survival Guide for the Certificate and PKI Revolution

Recent and impending reductions in the validity periods of publicly trusted Transport Layer Security (TLS) certificates have significantly elevated the risk of enterprise web service outages. To prevent severe operational disruptions, cybersecurity leadership must immediately modernize Public Key Infrastructure (PKI) frameworks and transition to automated certificate lifecycle management.

This reports discusses the following key insights:

• Accelerated validity reductions and validation constraints: To enhance cryptographic agility and minimize risk exposure, public certificate lifespans are projected to decrease from 398 days to 47 days by 2029. Concurrently, Domain Control Validation (DCV) reuse windows will be reduced from 398 days to 10 days by 2029, with manual DCV methodologies completely phased out by 2028. For organizations reliant on legacy, manual renewal processes, this shift introduces unsustainable administrative overhead and a high probability of service degradation.
• Deprecation of Public Client Authentication: By 2027, the Client Authentication Extended Key Usage (EKU) extension will be formally deprecated within publicly trusted certificates. Consequently, enterprises utilizing public certificates for client-side authentication will face a hard stop on renewals, necessitating an immediate migration toward private PKI architectures or alternative authentication mechanisms.
• Post-Quantum Cryptography (PQC) readiness: In preparation for post-quantum security standards, industry leaders—including Google and Cloudflare—are conducting feasibility studies on Merkle Tree Certificates (MCs) to mitigate potential performance overhead. This transition will fundamentally alter internet protocols, certificate structures, and vendor provisioning workflows globally.

We believe Sectigo's offering can help you establish digital trust for your human and machine identities. To find out more, contact us.