TL;DR

• On 15 March 2027 the maximum validity of public TLS certificates falls to 100 days, then 47 days in 2029. There are four realistic responses: standardise on a leading certificate authority, add a CA-neutral management platform, do nothing and renew by hand, or build your own from open-source tools.
• Each option trades cost, control and effort differently. Doing nothing is cheapest this year and the most expensive by 2029, when domain validation reuse falls to 10 days; DIY works for simple estates but struggles with ownership, reporting and OV or EV certificates.
• There is no single right answer, and market share by volume (dominated by free Let’s Encrypt certificates) says little about enterprise needs. The best choice depends on how many certificates you have, how many authorities issue them, and whether you need internal and external certificates managed together.

The Decision in Front of You

The CA/Browser Forum schedule is fixed: maximum validity is 200 days now, 100 days from 15 March 2027, and 47 days from 15 March 2029, with domain validation reuse falling to 10 days by 2029. We covered the schedule and why it matters in our earlier piece on certificate lifespans, and the NCSC’s Web PKI guidance advises automated renewal such as ACME. This article is about the next question: how.

With a little over five months to the next step, here are the four options we see CISOs and CIOs weighing, with an honest view of each. Vendor capabilities are as described by the vendors, so confirm current details before you buy.

Who Issues Certificates Today: Volume Versus Value

Before choosing a route, it helps to know who actually issues certificates. Two public trackers, W3Techs (websites) and TechnologyChecker, using Cloudflare Radar certificate transparency data (final certificates issued), give a consistent picture at the top and different ones below it:

Certificate authority	Share of websites (13 October 2026)	Share of final certificates (Q3 2026)
Let’s Encrypt	64.3%	80.4%
GlobalSign	20.9%	Not in the top five
GoDaddy Group	3.5%	9.1%
Google Trust Services	Not separately listed	5.3%
Sectigo	4.6%	3.8%
DigiCert Group	1.6%	0.9%

• Volume is not value: free, automated domain validation dominates counts, while paid organisation and extended validation certificates, support and governance sit with commercial authorities. Mordor Intelligence puts domain validation at 52.33% of certificate authority revenue in 2025, in a market it sizes at USD 232.31 million for 2026.
• Mordor lists DigiCert, Sectigo, GoDaddy, GlobalSign and Entrust as the five largest commercial vendors, with roughly 55 to 60% combined share of that revenue. Its analysts describe revenue shifting towards “subscription contracts tied to automated renewal volumes”.
• Counting method matters: precertificates were 47.1% of all certificate transparency records in Q3 2026, which inflates authorities that log mostly precertificates, such as Amazon. TechnologyChecker itself flags this caveat, so we use final certificates as the fairer measure.
• Cloud providers are also becoming certificate authorities in their own right, with Amazon, Google and Microsoft embedding issuance in their platforms, which Mordor flags as raising lock-in risk.

The takeaway for a CISO: choosing a free authority for volume and a commercial one for assurance and management are different decisions, and most of the four options below combine both.

Option 1: Standardise on a Leading Certificate Authority

The simplest route is to consolidate on one large, established commercial authority and use its platform for issuance, renewal and visibility. DigiCert is the example we know best: its CertCentral and Trust Lifecycle Manager support ACME for DV, OV and EV certificates, discover certificates across networks, clouds and endpoints (including those from other providers), and DigiCert describes managed private CA options so internal and external certificates can sit in one place. Other established authorities, such as Sectigo, also publish certificate lifecycle tooling aimed at the shorter lifetimes.

• Best for: mixed estates that want one supplier, one console and support across public and private certificates.
• Watch for: dependence on one authority, and the fact that capability varies by plan, so check which tier covers multi-CA discovery.
• Pricing note: DigiCert states its pricing is an annual subscription rather than per replacement, so more frequent renewal does not in itself raise the bill. Confirm against your own contract.

Option 2: Add a CA-Neutral Platform on Top

The second route is to keep your existing authorities and add a lifecycle management platform above them. AppViewX AVX ONE CLM is a good example: AppViewX describes connecting to public and private certificate authorities from one console, with ACME, automated domain validation and support for short-lived certificates. Other certificate lifecycle platforms exist, so shortlist more than one.

• Best for: estates already using several authorities, or those that want freedom to change authority without rebuilding automation.
• Watch for: another product to license, deploy and own, and integration work with the systems where certificates are installed.
• Ask: how the platform handles domain validation as reuse falls to 10 days, since that is where manual steps reappear.

Option 3: Do Nothing and Renew by Hand

It is a legitimate option for a very small estate, and it costs nothing this year. A certificate issued before 15 March 2027 keeps its current validity, so the first real change is the first renewal after that date. After that the arithmetic turns:

From	Maximum validity	Renewals a year, per certificate	Manual domain validation reuse
Today	200 days	About 2	200 days
15 March 2027	100 days	About 4	100 days
15 March 2029	47 days	Nearly 8	10 days

The risk is not the first step, it is the third. Hand renewal that copes with two cycles a year rarely survives eight, and by 2029 revalidating domains by hand every few days is unrealistic. If you choose this option, treat it as a deliberate, time-limited decision with an owner and a review date, not a default.

Option 4: Build Your Own From Open-Source Tools

Many teams can automate a good part of the estate with free tools, and for simple environments that is a sensible answer. The usual building blocks are:

Tool	Job it does	Note
Certbot and acme.sh	ACME clients that issue and renew certificates on individual servers	Typically run on a timer with a hook to reload the service
cert-manager	Automates certificates for Kubernetes workloads	A CNCF project and a common standard for containers
HashiCorp Vault PKI	An internal certificate authority; ACME is supported from Vault 1.14	Suits private certificates inside the estate
Smallstep step-ca and EJBCA	Private certificate authorities with ACME support	Alternatives for internal issuance
Let’s Encrypt	A free public certificate authority for DV certificates	Issues about four in five new certificates by volume, and has announced its own step-down to shorter defaults before 2029; check its current schedule
AWS Certificate Manager	Managed certificates for AWS services, plus a managed ACME endpoint announced in July 2026	Fits estates that are mostly on AWS

• Best for: simple, mostly web-server estates with strong in-house skills and few certificate types.
• Watch for: ownership and visibility gaps, no single inventory or approval workflow, and the fact that free public authorities issue DV certificates only, so OV and EV certificates need another route.
• Hidden cost: engineer time, and the person who built it moving on. Whatever you build needs monitoring on the automation itself, as the NCSC advises.

The Four Options Compared

Option	Effort now	Control	Coverage of internal and external	Main risk
1. Leading CA	Low to medium	Medium	Strong if the CA offers private and public	Dependence on one authority
2. CA-neutral platform	Medium	High	Strong across several authorities	Another product to own
3. Do nothing	None	Low	Manual	Outages as cycles shorten
4. DIY tooling	Medium to high	High, if skilled	Patchy without an inventory	Skills, ownership and reporting

How to Choose

• How many certificates do you really have, and do you know? If not, start with discovery, whichever option follows.
• How many authorities issue them? One points towards option 1, several towards option 2.
• Do you need OV or EV certificates, or internal certificates managed alongside public ones? That tends to rule out DIY on its own.
• Who owns this in 2029? If the answer is one engineer, buy something.

The options also combine. Many estates use open-source ACME clients for simple web servers and a platform for everything that needs governance, which is often the most economical shape.

What We’re Seeing in Practice

What we see most often when clients weigh these options:

• Teams start by choosing a product before they know how many certificates they have, then discover the estate is two or three times larger than assumed.
• DIY automation works well for the first dozen servers and becomes fragile once certificates sit across cloud, load balancers, appliances and supplier-hosted systems.
• The deciding factor is usually ownership, not technology: the organisations that cope best name a person responsible for certificates before they choose a tool.

UK & New Zealand Perspective

The options are the same in both markets, but the pressures differ:

• UK: larger, longer-lived estates with legacy and supplier-hosted systems favour discovery first, and public sector buyers can purchase through G-Cloud 15, where ITogether lists DigiCert and AppViewX services. As a UK DigiCert partner and a UK AppViewX partner, we can help with either.
• NZ: leaner, cloud-first teams often get the most from consolidating onto one platform. As a New Zealand Digicert partner and a New Zealand AppViewX partner, we also see strong interest in CA-neutral management where several authorities are already in use.

ITogether’s Independent Verdict

None of the four options is wrong in the right circumstances, and one of them, doing nothing, is only defensible for a handful of certificates and a time-limited plan. The error is not choosing at all and discovering the problem at the first 100-day renewal.

For most organisations between 50 and 5,000 staff, we would start with discovery, name an owner, then choose between a leading authority and a CA-neutral platform based on how many authorities you already use. DIY tools belong where the estate is simple and the skills are real. For European organisations on the same timetable, ITogether can support either DigiCert or AppViewX routes, and the same questions apply whichever product you choose.

👉 Not sure which of the four options fits your estate? Get in touch.

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com

FAQs

Which Certificate Automation Option Is Best?

It depends on estate size, how many certificate authorities you use, and whether you need internal and external certificates managed together. Small, simple estates can use open-source tools; mixed or regulated estates usually benefit from a platform.

Can We Wait Until 15 March 2027 to Act?

Technically yes, because certificates issued before that date keep their current validity. But renewal volumes double after it, and 47-day certificates with 10-day domain validation arrive in 2029, so a plan is needed well before the second step.

Do Internal Certificates Need to Follow the 47-Day Schedule?

No. The schedule applies to publicly trusted TLS certificates. Private PKI is not bound by it, though shorter internal lifetimes and automation are still good practice.

Is It Worth Using Both a Platform and Open-Source Tools?

Often, yes. Many teams use free ACME clients for simple servers and a platform for discovery, governance and the certificates that don’t fit a script.