Two mega trends are shaking up the world of Public Key Infrastructure (PKI): The radical shortening of certificate lifespans from 398 days to 47 days by 2029, and the looming transition to PQC. These separate trends, though distinct, are intertwined in both their motivations and the transformations they demand from the digital ecosystem.
New research from Sectigo, and analyst firm Omdia, has uncovered alarming findings on how prepared organizations are to face the dual challenges of drastically shorter SSL/TLS certificate lifespans and the shift to PQC. Omdia surveyed 272 IT decision-makers from medium to large enterprises across the world and the findings reveal a clear pattern: While awareness is high, execution is lagging. Many organizations know they need to act, but they lack clear roadmaps or the internal alignment to do so.
Key highlights from the research include:
47-day SSL/TLS certificates
- 96% of organizations are concerned about the impact of shorter SSL/TLS certificate lifespans on their business. Less than 1 in 5 (19%) organizations feel very prepared to support the coming shift to 47-day certificate renewal cycles.
- Only 5% have fully automated certificate management, leaving a staggering 95% who remain at least partially dependent on manual processes, dramatically increasing operational and disruption risk as renewal frequencies accelerate.
- Just 28% have a complete certificate inventory, and only 13% are extremely confident they are tracking all (even rogue) certificates.
PQC migration
- 98% of organizations have or expect to experience challenges with PQC implementation and 92% expect to encounter some sort of barrier during PQC implementation.
- Only 14% have conducted a full assessment of quantum-vulnerable systems.
- Only 15% feel extremely confident in their ability to integrate PQC without major disruption.
- 90% have budgets allocated to PQC preparedness initiatives within the next 12 months and 92% expect to increase that investment over the next 2-3 years.
Here is what industry experts are saying about how prepared organizations are to face the challenges of drastically shorter SSL/TLS certificate lifespans and the shift to PQC:
Rik Turner, chief analyst, cybersecurity at Omdia:
“Perhaps because they have been around for three decades, it’s like TLS certs have kind of been absorbed into the �plumbing’ that simply makes IT work, at least in the perception of many of our respondents. That’s why it feels like not enough of them are aware of the 47-day issue that’s barreling down the pike towards them, and don’t seem to have thought through the need for automation that it is going to impose on their organization.”
“It seems to me that there are two reasons not to simply wait till Q-Day. One is that technology has the ability to surprise us: witness the absolute explosion in AI adoption since ChatGPT was launched on an unsuspecting world in November 2022. The other is the suspicion that the bad guys aren’t waiting. In other words, threat actors may be harvesting your most heavily encrypted data now, in the expectation of being able to decrypt it as soon as they get their hands on a QC. And of course, if they are backed by nation-states, they’ll gain access to one long before the average company does”.
Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck:
Regulations, such as the EU Digital Operational Resilience Act, require businesses to prioritize cybersecurity activities based on risks to business operations. Expired or revoked certificates break the trust between clients and the underlying services – whether those clients are end users with browsers or encrypted channels between API powered business partners. Shortening expiration windows help reduce the potential impact of encryption key misuse while also promoting the use of automated key management systems.
Ben Volkow, Co-Founder and CEO at QIZ Security:
PQC migration is shaping up to be one of the biggest IT and cybersecurity challenges of the coming decade. The urgency isn’t just about the quantum threat-it’s also about untangling the cryptographic �jungle’ created over the last decade. We see the quantum risk as the catalyst for a new era of cryptography management-one that aligns with recent IT architecture shifts, the rise of AI, and the accelerating pace of advanced cyber threats.
PQC migration is already falling behind the pace of threat evolution-from rapid quantum advancements to the �harvest now, decrypt later’ risk and tightening regulatory timelines. What’s even more concerning is the lack of dedicated, automated tools-most migrations today are slow, service-heavy, and lack standardized frameworks. At QIZ, we’re bringing AI-driven automation to streamline, accelerate, and de-risk the entire PQC migration process.
The PQC risk is real, and most organizations are already behind the curve. But PQC migration isn’t just a defensive necessity-it’s a strategic opportunity to modernize cryptography management, much of which still relies on outdated architectures and concepts. This is a chance to align with today’s distributed IT models, AI-driven operations, and the risks of next-generation cyber threats.
PQC migration is both the greatest cryptographic risk and the biggest modernization opportunity of the decade-one that demands we move from outdated, fragmented crypto management to AI-driven, automated, and quantum-ready security.
Trey Ford, Chief Strategy and Trust Officer at Bugcrowd:
Effective certificate management is a root of trust for online systems, both in B2B and B2C operations, increasingly so in the modern cloud-native era.
Automated Certificate management environment (ACME) integrations have powered so much of the cloud-native movement, machine-to-machine authentication and IAM infrastructure relies heavily on automated provisioning and management, and Lets-Encrypt has brought this into the mainstream.
Strangely, the pervasive use of self-signed certificates in development and test environments has led to some strange and unexpected failures modes at scale – leading to the rise of cool companies like anchor.dev, specifically aimed at fully automating and simplifying full management of the certificate lifecycle – and accelerating the implementation of increasingly shorter certificate lifetimes.
The implementation of PQC has a variety of complications that companies and technology providers will need to test for – larger certificates, heavier cryptographic processing loads, new ciphers and libraries to support them. Increased compute, thanks to heavier crypto in PQC, will add power and time sensitivity demands – requiring heavy testing and planning for implementation.
PQC addresses both components of the parkerian hexad (confidentiality and possession) as the load required to decrypt captured exchanges over time will be much higher, leading to more resilient, and thus higher trust and confidence in the safety of those communications.
