47-Day TLS/SSL Certificates:
Are you ready?

If you manage your certificates manually, it will start getting harder to keep up with the work next year. In 2029, it will be completely impractical to do so. You have 3 options based on your specific use case: Automate your certificate renewals, move the certificates to a private PKI, or, for certain applications, adopt the new X9 PKI.

A private PKI runs entirely within your own networks. It and the certificates it manages are not accessible or trustworthy outside your networks. If your certificates can work this way, then a private PKI is the most secure and appropriate solution for you.

Automation using open-source tools and standards usually works but does not scale. If you have more than a few certificates, you need a system that can track all the certificates and make changes to policy and their management in a coordinated way. If not, and you need to make a change, you must work on every affected server individually. Also, only a professional CLM solution will provide discovery and inventory of certificates, policy management, and other critical features.

The X9 PKI is a public PKI, but independent of the Web PKI which is run by web browsers and the CA/B Forum. X9 is managed by an ANSI committee. It was designed to meet the needs of the financial services industry but is available to other industries and may meet their needs as well. In the short term, the main use case will be for mutual TLS (mTLS) communications among financial services and with their customers.