Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place. Their more specific answers point elsewhere. Only 4% said their certificate management is already automated, and 61% said their organization had a certificate-related outage […]
Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place. Their more specific answers point elsewhere. Only 4% said their certificate management is already automated, and 61% said their organization had a certificate-related outage or incident in the past 12 months.
Source: Sectigo
A TLS certificate is the file a website or service presents to prove who it is and set up an encrypted connection. The CA/Browser Forum, the industry body that sets rules for publicly trusted certificates, cut their maximum lifespan from 398 days to 200 on March 15, 2026. The limit drops to 100 days on March 15, 2027, and to 47 days on March 15, 2029. An organization that renews by hand now repeats that work about every six months per certificate, and each round is another chance to miss a step and take a service down.
The automation numbers don’t add up
Censuswide collected the responses for Sectigo between July 2 and July 21, 2026, across North America, EMEA, and APAC. The most telling result is how much of their TLS certificate renewal each organization has automated: about 61% of respondents automate half or fewer of their renewals, and just 4% automate more than 90%.
Add up the remaining bands and at most 35% of respondents automate more than half their renewals. That is five points short of the 40% who called themselves very prepared because automation is already in place. No cross-tabulation appears in the published results, so there is no telling exactly which respondents overlap. The totals still mean that at least some of the very prepared group either automate half or fewer of their renewals or don’t know the figure. Seventy-three percent said they plan to increase automation because of the shorter lifespans.
Confident about certificates they can’t see
Respondents were just as sure of themselves on tracking. Thirty-three percent said they are extremely confident they track all certificates, including rogue ones, and another 48% said they are very confident. A rogue certificate is one issued without the IT team’s knowledge, so certainty about having found every one of them is hard to check from the inside.
Sixty-two percent said they keep a complete, up-to-date inventory of their public TLS certificates, up from 28% in 2025.
The confidence extends to post-quantum cryptography (PQC), the new algorithms built to withstand future quantum computers. Twenty-eight percent were extremely confident and 46% very confident that their current systems can integrate PQC without major disruption. That is 74% of the same sample in which 61% reported a certificate incident in the past year.
“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice,” said Nick France, CTO at Sectigo.
The next cut, to 100 days, takes effect on March 15, 2027, and puts renewals on a roughly three-month cycle. The 61% who reported a certificate incident were describing the 12 months before July 2026, most of which ran under the old 398-day limit.
Download eBook: Identity-First Threat Intelligence
