PKI-as-a-Service: Why Managed PKI Matters as Certificate Lifetimes Shrink to 47 Days

Public TLS certificates are about to renew far more often than most Public Key Infrastructure (PKI) teams have ever planned for. The CA/Browser Forum’s Ballot SC-081v3, approved in April 2025, cuts the maximum validity of publicly trusted TLS certificates in stages: from 398 days down to 200 days effective March 2026, then to 100 days in March 2027, and finally to 47 days by March 2029. That is roughly an eightfold increase in how often a certificate needs to be reissued compared to today.

This change fundamentally changes how PKI needs to operate. When certificates lasted a year or more, many organizations relied on annual renewals, manual tracking, and occasional spreadsheet reviews. It was not ideal, but it usually got the job done. With certificates lasting only 47 days, that approach no longer works. The chances of missing a renewal and causing an outage become much higher. That is why PKI-as-a-Service matters. It is not just a cloud-hosted service. It is an operating model designed to keep up with frequent certificate renewals.

Quick Answer: What Is PKI-as-a-Service and Why Does It Matter Now?

PKI-as-a-Service (PKIaaS) is a fully managed model where a provider hosts and operates certificate authority infrastructure, including CA hierarchy, HSM-backed key protection, automated issuance, renewal, revocation, and continuous monitoring. It matters now because CA/Browser Forum Ballot SC-081v3 mandates 47-day TLS certificate validity by March 2029, making manual, periodic PKI management operationally unviable at enterprise scale.

Key Takeaways

• CA/Browser Forum Ballot SC-081v3 (April 2025) reduces maximum publicly trusted TLS certificate validity from 398 days to 47 days by March 2029, in three phases: 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. This increases renewal frequency roughly eightfold and makes manual certificate management operationally unviable at enterprise scale.
• According to DigiCert’s Trust Pulse Survey (July 2, 2025), nearly half of all enterprises experienced certificate-related downtime in the past year under the previous annual renewal cadence. At 47-day validity, the window between a missed renewal and a production outage is less than seven weeks, compressing the already-insufficient time that manual processes provide.
• The 47-day mandate creates three non-negotiable operational requirements: automation (manual renewal processes cannot scale to eight cycles per year per certificate), continuous visibility (a complete, current inventory of every certificate and its expiry is a prerequisite for automated renewal), and automatable enrollment protocols (ACME, SCEP, EST, and CMP at the CA layer; manual CSR submission does not scale).
• NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024. Any PKIaaS deployment decision made today must include evaluation of PQC certificate issuance capability, because every CA hierarchy built now will need to issue ML-DSA and ML-KEM certificates within the operational lifetime of the infrastructure.
• CA private keys must be protected by FIPS 140-3 Level 3 certified Hardware Security Modules in any PKIaaS deployment that serves regulated industries or government environments. Level 3 HSMs provide tamper-evident physical security and identity-based authentication for key operations, meeting the requirements of PCI DSS, HIPAA, DORA, and federal frameworks.

Who Should Care About PKI-as-a-Service and the 47-Day Mandate

The 47-day certificate mandate is a cross-functional operational change. Every role below has a direct stake in whether the organization’s PKI infrastructure can scale to the new renewal cadence before the first enforcement deadline in March 2026.

Role	Why It Matters	Action Item
PKI Admins	Own the CA infrastructure that must scale to eight renewal cycles per year per certificate; responsible for verifying PKIaaS HSM key protection, enrollment protocol support, and integration with CLM tooling	Evaluate PKIaaS providers for FIPS 140-3 Level 3 HSM backing, ACME and SCEP support, and CRL/OCSP infrastructure; run a complete certificate inventory using CBOM Secure to identify all certificates that must transition to automated renewal; integrate all issued certificates into CertSecure Manager
Security Architects	Own the trust model design: self-managed CA vs. PKIaaS vs. hybrid; the CA hierarchy design decision (shared issuing CA vs. dedicated root vs. bring-your-own-root); and PQC readiness requirements for the new infrastructure	Design the CA hierarchy for both current RSA/ECDSA and planned ML-DSA issuance; confirm PKIaaS provider supports hybrid PQC certificates alongside classical algorithms; evaluate CNSA 2.0 compliance timeline for any NSS-adjacent environments
Platform / DevOps Teams	Own the ACME and SCEP client configuration on TLS servers, API gateways, service meshes, and container platforms; most likely to encounter expiry outages when automated enrollment is not configured before validity periods shorten	Audit all TLS endpoints for ACME or SCEP client configuration; confirm enrollment protocol integration with the PKIaaS CA before March 2026 (200-day deadline); test automated renewal end-to-end on a representative sample before broad deployment
Compliance Teams	Must demonstrate that certificate issuance, key protection, revocation, and audit logging meet PCI DSS, HIPAA, DORA, NIS2, and applicable regulatory requirements both before and after PKIaaS migration; the transition creates a compliance evidence gap if not documented	Map PKIaaS SLA and audit evidence capabilities to applicable regulatory requirements; confirm FIPS 140-3 Level 3 HSM attestation is available from the provider; document the migration plan and timeline as a formal change management record
CISOs	Own the build-vs-buy risk decision for PKI infrastructure under the 47-day mandate; own the budget allocation for PKIaaS subscription vs. in-house CA infrastructure capital and staffing; own the enterprise risk posture if certificate expiry outages scale with the renewal frequency	Commission a PKI health assessment to evaluate current infrastructure against the 47-day operational requirements; require a build-vs-buy analysis covering CA infrastructure TCO, HSM capital, staffing, and compliance cost; include PKIaaS migration in enterprise risk register and board-level PKI resilience reporting

What Shrinking Certificate Lifetimes Actually Demand

A 47-day validity period does not just mean renewing more often. It changes the entire operational profile of a PKI program in three specific ways.

First, automation stops being optional. A process that depended on a person remembering to act, even a well-run one, cannot keep pace with renewals happening roughly eight times more frequently than today. Issuance, renewal, and revocation all need to happen through automated workflows triggered by policy and expiry, not by someone checking a calendar.

Second, visibility has to be continuous rather than periodic. If you do not have an accurate, current inventory of every certificate in your environment, the systems that depend on it, and when each one expires, a 47-day cycle will surface that gap as an outage rather than as a finding in next quarter’s audit.

Third, the enrollment protocols a PKI environment supports start to matter more directly. Manual certificate signing requests do not scale to this frequency. Standardized, automatable protocols, the kind that integrate cleanly with existing infrastructure and certificate management tooling, become the baseline requirement rather than a nice-to-have.

None of this is a reason to panic. It is a reason to treat PKI operations as infrastructure that needs to run continuously and automatically, which is exactly the gap PKI-as-a-Service is built to close.

Self-Managed PKI vs. PKI-as-a-Service: Build vs. Buy Decision Table

Use this table to frame the build-vs-buy conversation before the next budget cycle. Each row maps a critical PKI operational area to how self-managed and PKIaaS approaches compare across control, cost, compliance, and automation fit at the 47-day renewal cadence.

Area	Self-Managed PKI	PKI-as-a-Service (PKIaaS)	What Matters at 47 Days
CA hierarchy control	Full control: root CA, intermediate CA, and all policy decisions owned internally	Dedicated issuing CA with provider-operated infrastructure; bring-your-own-root options available	Hierarchy design matters less than renewal automation; a well-configured PKIaaS issuing CA with ACME support outperforms a self-managed CA with manual renewal at 47-day cadence
HSM key protection	Requires capital purchase of FIPS 140-3 Level 3 validated HSMs; in-house HSM operations and key ceremony management	FIPS 140-3 Level 3 Cloud HSMs included; provider manages HSM operations, key ceremonies, and backup	Both must meet FIPS 140-3 Level 3 for regulated environments; PKIaaS removes the capital cost and operational overhead of in-house HSM management
Automation (ACME/SCEP/EST)	Requires custom CA gateway configuration; ACME support varies by CA platform; significant integration engineering effort	Native ACME, SCEP, EST, and CMP support included; provider maintains protocol compatibility	ACME support is a hard requirement for 47-day automation; self-managed AD CS requires additional tooling; PKIaaS provides this natively
Certificate lifecycle visibility	Requires separate CLM platform investment; no built-in cross-CA inventory	Integrates with CertSecure Manager for unified discovery, inventory, expiry monitoring, and renewal across all CA sources	Both require CLM investment; PKIaaS integration with CertSecure Manager provides the multi-CA inventory visibility needed at 47-day cadence
Compliance (PCI DSS, HIPAA, DORA)	Organization owns all audit evidence; WebTrust or equivalent requires ongoing independent audit; compliance program built and maintained in-house	Provider supplies audit evidence for CA operations; shared compliance model reduces internal audit burden	PKIaaS shifts CA-layer compliance burden to the provider; organization retains responsibility for certificate governance and CLM compliance evidence
PQC readiness	Requires CA platform upgrade to support ML-DSA; AD CS ML-DSA support available on Windows Server 2025 with May 2026 update; parallel hierarchy required	Native PQC certificate issuance capability for ML-DSA alongside classical algorithms; hybrid certificate support included	Any PKI infrastructure decision made today must include ML-DSA issuance capability; PKIaaS providers with native PQC support reduce the migration effort
Uptime and SLA	Organization owns availability; no external SLA; DR and failover require in-house engineering and capital	Contracted SLA (typically 99.9% or higher); provider owns HA, DR, failover, and 24/7 monitoring	At 47-day renewal cadence, CA unavailability directly delays certificate renewal; a contracted SLA provides accountability that self-managed infrastructure cannot
Total cost of ownership	HSM capital ($30K-$100K+ per appliance), Windows Server licensing, PKI staff expertise, DR infrastructure, annual WebTrust audit	Subscription model; no HSM capital; provider absorbs infrastructure, staffing, and audit costs	As renewal frequency increases, internal operational cost of self-managed PKI scales with staff time; PKIaaS subscription cost is fixed regardless of renewal volume
Best fit	Organizations with existing PKI investment, regulatory requirements for in-house CA control, and dedicated PKI team	Organizations prioritizing automation, reducing PKI operational overhead, or without a dedicated PKI team	For most enterprises not subject to sovereign CA requirements, a hybrid approach retaining in-house root CA with PKIaaS issuing CA provides the best balance of control and automation

What a Fully Managed PKIaaS Actually Provides

Encryption Consulting’s PKIaaS is built around the idea that an organization should not have to choose between owning its PKI and avoiding the operational burden of running one. The service removes operational complexity while keeping certificate issuance tied to verified identity and strong key protection throughout.

Identity-Bound Issuance

Every certificate is issued only after the identity of the requesting user, device, or workload has been verified. Automating this identity validation ensures that certificates are consistently issued according to organizational security policies, even when certificates need to be renewed much more frequently. At 47-day cadence, the frequency of issuance cannot come at the cost of loosening the identity controls around it.

Strong Protection for CA Keys

The security of a PKI ultimately depends on protecting the certificate authority’s private keys. Encryption Consulting’s PKIaaS secures these keys using FIPS 140-3 Level 3 certified Cloud HSMs, enforces multi-factor authentication for Root CA access, and implements strict access controls to reduce the risk of compromise. The issuing CA environment runs on dedicated, single-tenant architecture with real-time CRL infrastructure, monitoring, and backup and recovery built in.

Automated Certificate Lifecycle Management

One of the biggest advantages of PKIaaS is automation. Certificate issuance, renewal, revocation, and replacement can all be handled automatically, reducing manual effort and minimizing the risk of expired certificates causing outages. As certificate validity periods become shorter, automation shifts from being a convenience to becoming a structural necessity. The service integrates with CertSecure Manager for unified discovery, inventory, expiry monitoring, and renewal workflow across all CA sources.

Support for Post-Quantum Cryptography

Modern PKIaaS platforms increasingly support both traditional and post-quantum cryptographic algorithms, along with hybrid deployments during the migration period. Encryption Consulting’s PKIaaS supports native PQC capabilities to issue ML-DSA certificates alongside hybrid certificate management, so each of the far more frequent renewal cycles a 47-day world creates becomes an opportunity to move toward post-quantum readiness rather than just maintaining the status quo. NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024. Begin PQC readiness planning via the PQC Readiness assessment and the PQC Center of Excellence.

Dedicated, Single-Tenant Infrastructure

Enterprise deployments often require dedicated infrastructure with built-in redundancy, monitoring, backup, and disaster recovery capabilities. High availability becomes even more important as certificate renewal events occur more frequently throughout the year. A contracted SLA at or above 99.9% provides the accountability for CA availability that self-managed infrastructure cannot offer.

24/7 Monitoring and Continuous Compliance

Most managed PKI services include continuous monitoring, regular maintenance, software updates, and support for common compliance frameworks. By handling operational tasks such as certificate authority maintenance, patching, CA and CRL renewals, patch management, and incident response, organizations can reduce administrative burden while maintaining a secure and reliable PKI environment.

Use Cases Where PKIaaS Matters Most

The benefits of a managed PKI become most apparent in environments where certificates are issued, renewed, and managed at scale. As certificate lifetimes shrink, these use cases become even more dependent on automation.

Endpoint Authentication

Issuing high-assurance certificates to secure managed devices and applications, with automated revocation and policy management, and real-time synchronization with hybrid certificate support, for endpoint authentication across UEM and MDM platforms including Microsoft Intune. At 47-day validity, device certificate renewal must be fully automated through SCEP or ACME clients integrated with the MDM platform, not initiated manually by device owners.

Automated Enrollment at Scale

Large environments often need to provision certificates for thousands of users, devices, and workloads. Automated enrollment through protocols and integrations such as ACME (RFC 8555), SCEP (RFC 8894), and enterprise identity platforms eliminates manual provisioning while ensuring certificates are issued consistently according to organizational policies. This is the only realistic operating model for a 47-day renewal cadence across a large certificate estate.

Managed CA Operations

Running a certificate authority involves much more than issuing certificates. It includes protecting CA keys in FIPS 140-3 Level 3 HSMs, maintaining certificate revocation services, monitoring infrastructure, performing backups, applying security updates, and ensuring high availability. A managed PKI service handles these operational responsibilities while allowing organizations to maintain governance over their PKI. As renewal volume scales with shorter validity periods, operational overhead scales proportionally for self-managed environments; PKIaaS absorbs that scaling cost.

How PKIaaS Connects Into the Rest of Your Environment

A managed PKI only helps if it actually integrates with how certificates get requested and consumed across your environment. Encryption Consulting’s PKIaaS supports a broad set of enrollment paths and integrations: CA gateways, REST API access, ACME, agent-based and orchestration-driven enrollment, SCEP, Active Directory integration, and Microsoft Intune for managed devices. On the hardware security module side, the service integrates with Thales and Entrust HSMs. For secure email, it supports S/MIME across Gmail and Outlook.

That breadth matters specifically because of the lifecycle shrinkage driving this entire conversation. SCEP (defined in RFC 8894) and ACME (RFC 8555) exist precisely to make automated, machine-driven enrollment possible without a human submitting a request manually each time, which is the only realistic way to operate at a 47-day cadence across a large certificate estate. For complete cryptographic visibility across all environments where PKIaaS operates, CBOM Secure builds a Cryptographic Bill of Materials that surfaces certificate lineage, algorithm coverage, and CA source data across cloud, on-premises, and hybrid environments.

How Encryption Consulting Can Help

Getting ready for a 47-day certificate renewal cycle is not just about certificates. It is an operational challenge, and it is exactly what Encryption Consulting’s PKIaaS is designed to handle much of that complexity for your team.

This starts with the foundation: a fully managed, scalable, and highly available PKI service that removes the operational complexity of running CA infrastructure in-house, including built-in expertise for hybrid certificate management and PQC readiness. Self-service capabilities combined with automated issuance, renewal, and revocation mean certificates do not depend on someone remembering to act, which is the single biggest requirement a shrinking renewal cycle creates. Every request stays tied to a verified, authenticated identity, so increasing the frequency of issuance does not mean loosening the controls around it.

On the infrastructure side, critical CA keys are protected with FIPS 140-3 Level 3 certified Cloud HSMs, with multi-factor authentication enforced for Root CA access, and the issuing CA environment runs on a dedicated, single-tenant architecture with real-time CRL infrastructure, monitoring, and backup and recovery built in, so availability keeps pace as renewal volume goes up. Continuous compliance is maintained through 24/7 monitoring, alongside expert-led operations covering CA and CRL renewals, patch management, and incident response.

On the integration side, the service connects into the protocols and platforms that make frequent, automated renewal actually achievable: CA gateways, REST API access, ACME, SCEP, Active Directory, and Microsoft Intune, along with HSM integration through Thales and Entrust. And because the platform supports native PQC capabilities to issue ML-DSA certificates alongside hybrid certificate management, each of the far more frequent renewal cycles a 47-day world creates becomes an opportunity to move toward post-quantum readiness rather than just maintaining the status quo.

Whether your organization needs a fully hosted PKIaaS, an on-premises managed deployment, or a SaaS-based approach to establishing digital identities, Encryption Consulting’s PKIaaS is designed to scale with the pace certificate lifecycles are now moving at, without requiring you to grow your internal PKI team to keep up.

Conclusion

Certificate lifetimes are getting shorter because the industry decided that long-lived certificates carry too much risk for too long, and that decision is now locked into a published timeline that every organization issuing publicly trusted TLS certificates will have to meet. By 2029, certificates that once lasted over a year will need to be reissued roughly every six weeks. Manual, periodic PKI management was never a great fit for security-critical infrastructure, and it stops being viable at all once renewal happens at that frequency.

PKI-as-a-Service exists to meet that shift directly: identity-bound, automated issuance, FIPS 140-3 Level 3 protected keys with enforced access controls, native support for post-quantum algorithms like ML-DSA, and integration with the enrollment protocols and platforms that make frequent, automated renewal actually workable. If your organization is still managing certificates on an annual cycle, the runway to adapt before 47-day certificates arrive is shorter than it looks.

If you are evaluating how your current PKI setup would hold up under that shift, that is exactly the question a PKI health assessment is built to answer.

Frequently Asked Questions

What is the main takeaway from PKI-as-a-Service: Why Managed PKI Matters as Certificate Lifetimes Shrink to 47 Days?

CA/Browser Forum Ballot SC-081v3 (April 2025) reduces maximum TLS certificate validity to 47 days by March 2029, increasing renewal frequency roughly eightfold. At that cadence, manual certificate management is not operationally viable. PKI-as-a-Service provides the automated issuance, identity-bound enrollment, FIPS 140-3 Level 3 HSM-backed key protection, and continuous monitoring that organizations need to keep pace without proportionally growing their internal PKI team.

Why does the 47-day certificate mandate matter for enterprise PKI teams?

Enterprise PKI teams are directly responsible for the certificate infrastructure that must scale to roughly eight renewal cycles per year per certificate by 2029. According to DigiCert’s Trust Pulse Survey (July 2, 2025), nearly half of enterprises experienced certificate-related downtime in the past year under the previous annual renewal cadence. At 47 days, the window between a missed renewal and a production outage is less than seven weeks. PKI teams that have not automated issuance, renewal, and monitoring before the 47-day deadline will face compounding outage risk as certificate volumes grow.

What risks increase if PKI is managed manually under a 47-day certificate schedule?

Manual PKI management under a 47-day schedule increases the risk of certificate expiry outages because the renewal window is too short for ticket-based, human-driven processes; inventory gaps where certificates issued outside the central tracking system are discovered only after they expire; CA key exposure because manual key ceremonies create operational windows where key security is not continuously enforced; and compliance failures because audit evidence for identity-bound issuance, key protection, and revocation timeliness cannot be produced reliably without automated logging.

Which teams should own the decision to move to PKI-as-a-Service?

PKI admins own the technical evaluation. Security architects own the trust model and CA hierarchy design. Compliance teams own the regulatory mapping: confirming PKIaaS SLA and audit evidence meets PCI DSS, HIPAA, DORA, and applicable standards. CISOs own the build-vs-buy risk decision and the budget allocation for PKIaaS subscription versus in-house CA infrastructure capital and staffing.

How does PKI-as-a-Service connect to certificate lifecycle management?

PKIaaS is the CA infrastructure layer that issues, renews, and revokes certificates. Certificate lifecycle management (CLM) is the operational layer that discovers, tracks, monitors, and governs those certificates across all systems. CertSecure Manager handles the discovery, inventory, expiry monitoring, owner assignment, and renewal workflow on the consuming side. Without both layers working together, automation at the CA level does not prevent outages caused by certificates never enrolled in the renewal workflow.

How should organizations measure success after moving to PKI-as-a-Service?

Key metrics: percentage of certificates enrolled in automated renewal workflows (target: 100% of all certificates under 47-day validity); number of certificate expiry outages per quarter (target: zero); mean time from expiry alert to renewed certificate deployed (target: automated, under 1 hour); percentage of CA key operations performed with FIPS 140-3 Level 3 HSM backing (target: 100%); and PKIaaS SLA uptime achieved versus contracted SLA (target: at or above contracted SLA).

What should be audited or monitored regularly for PKI-as-a-Service?

Monitor continuously: certificate expiry status across all enrolled certificates; ACME and SCEP enrollment success/failure rates; CRL and OCSP responder availability; and CA infrastructure uptime and HSM health. Audit quarterly: PKIaaS SLA compliance; identity-bound issuance audit logs; FIPS 140-3 Level 3 HSM key protection status; PQC readiness progress via the PQC Center of Excellence; and CBOM Secure cryptographic inventory to confirm no quantum-vulnerable algorithm has been introduced.

How does the 47-day mandate affect cloud, hybrid, or multi-CA PKI environments?

In cloud and hybrid environments, the 47-day mandate affects every publicly trusted TLS certificate regardless of where the consuming system runs. Cloud workloads, API gateways, service meshes, and container platforms that currently receive certificates on annual cycles must be connected to automated enrollment via ACME or SCEP before 2029. Multi-CA environments must have CLM tooling with multi-CA inventory visibility to ensure no certificate in any CA hierarchy falls outside the renewal automation coverage.

What common mistakes should teams avoid when evaluating or deploying PKI-as-a-Service?

The most common mistakes: choosing a PKIaaS provider without verifying FIPS 140-3 Level 3 HSM backing for CA keys; treating PKIaaS as a drop-in replacement for CLM tooling (both layers are required); not enrolling all certificates in automated renewal workflows before migrating to shorter validity periods; and not including PQC readiness requirements in the PKIaaS vendor evaluation, since ML-DSA certificate issuance capability is a requirement for any PKI infrastructure decision made today.

What prerequisites are required before deploying PKI-as-a-Service?

Prerequisites include: a complete certificate inventory using CBOM Secure to identify all certificates that must transition to automated renewal; confirmation of which enrollment protocols (ACME, SCEP, EST, CMP) are supported by consuming systems and the PKIaaS provider; a CA hierarchy design decision; FIPS 140-3 Level 3 HSM validation confirmation from the provider; and a CLM platform integration plan confirming CertSecure Manager is configured to manage all certificates issued from the new PKIaaS CA.

What should be refreshed quarterly for PKI-as-a-Service governance?

Refresh quarterly: certificate inventory audit confirming 100% of certificates under 47-day validity are enrolled in automated renewal workflows; PKIaaS SLA compliance review; FIPS 140-3 Level 3 HSM attestation confirmation; PQC readiness review via the PQC Center of Excellence for NIST FIPS 203, 204, and 205 migration planning; and CBOM Secure cryptographic inventory run confirming no quantum-vulnerable algorithm has been introduced into the certificate estate since the last review.